1. Home
  2. ATT&CK Techniques
  3. T1568 Dynamic Resolution

T1568 Dynamic Resolution

Adversaries may dynamically establish connections to command and control infrastructure to evade common detections and remediations. This may be achieved by using malware that shares a common algorithm with the infrastructure the adversary uses to receive the malware's communications. These calculations can be used to dynamically adjust parameters such as the domain name, IP address, or port number the malware uses for command and control.

Adversaries may use dynamic resolution for the purpose of Fallback Channels. When contact is lost with the primary command and control server malware may employ dynamic resolution as a means to reestablishing command and control.(Citation: Talos CCleanup 2017)(Citation: FireEye POSHSPY April 2017)(Citation: ESET Sednit 2017 Activity)

View in MITRE ATT&CK®

CRI Profile Mappings

Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
DE.AE-02.01 Event analysis and detection Mitigates T1568 Dynamic Resolution
Comments
This diagnostic statement provides for implementation of methods to block similar future attacks via security tools such as antivirus and IDS/IPS to provide protection against threats and exploitation attempts.
References
    DE.CM-01.01 Intrusion detection and prevention Mitigates T1568 Dynamic Resolution
    Comments
    Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate some obfuscation (command and control) activity at the network level.
    References
      PR.IR-01.03 Network communications integrity and availability Mitigates T1568 Dynamic Resolution
      Comments
      This diagnostic statement protects against Dynamic Resolution through the use of secure network configurations, architecture, implementations of zero trust architecture, and segmentation.
      References

        NIST 800-53 Mappings

        Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
        CA-07 Continuous Monitoring mitigates T1568 Dynamic Resolution
        SC-21 Secure Name/Address Resolution Service (Recursive or Caching Resolver) mitigates T1568 Dynamic Resolution
        SC-22 Architecture and Provisioning for Name/Address Resolution Service mitigates T1568 Dynamic Resolution
        SC-20 Secure Name/Address Resolution Service (Authoritative Source) mitigates T1568 Dynamic Resolution
        SI-03 Malicious Code Protection mitigates T1568 Dynamic Resolution
        SI-04 System Monitoring mitigates T1568 Dynamic Resolution
        AC-04 Information Flow Enforcement mitigates T1568 Dynamic Resolution
        SC-07 Boundary Protection mitigates T1568 Dynamic Resolution

        VERIS Mappings

        Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
        action.malware.variety.Disable controls Disable or interfere with security controls related-to T1568 Dynamic Resolution
        action.hacking.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1568 Dynamic Resolution
        action.hacking.vector.Other network service Network service that is not remote access or a web application. related-to T1568 Dynamic Resolution
        action.malware.variety.Backdoor or C2 Malware creates a remote control capability, but it's unclear if it's a backdoor for hacking or C2 for malware. Parent of 'C2' and 'Backdoor'. related-to T1568 Dynamic Resolution
        action.malware.variety.C2 Malware creates Command and Control capability for malware. Child of 'Backdoor or C2'. related-to T1568 Dynamic Resolution
        action.malware.vector.Download by malware Downloaded and installed by local malware related-to T1568 Dynamic Resolution

        Azure Mappings

        Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
        alerts_for_dns Alerts for DNS technique_scores T1568 Dynamic Resolution
        Comments
        Can identify "random" DNS occurences which can be associated with domain generation algorithm or Fast Flux sub-techniques. Partial for coverage and accuracy (potential for false positive/benign).
        References
        1. https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-dns
        azure_dns_analytics Azure DNS Analytics technique_scores T1568 Dynamic Resolution
        Comments
        This control can be used for after-the-fact analysis of potential fast-flux DNS C2
        References
        1. https://learn.microsoft.com/en-us/previous-versions/azure/azure-monitor/insights/dns-analytics

        AWS Mappings

        Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
        amazon_guardduty Amazon GuardDuty technique_scores T1568 Dynamic Resolution
        Comments
        GuardDuty has the following finding types to flag events where adversaries may dynamically establish connections to command-and-control infrastructure to evade common detections and remediations. Trojan:EC2/DGADomainRequest.B Trojan:EC2/DGADomainRequest.C!DNS
        References
        1. https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-ec2.html#recon-ec2-portscan
        2. https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_findings.html

        ATT&CK Subtechniques

        Technique ID Technique Name Number of Mappings
        T1568.002 Domain Generation Algorithms 17
        T1568.001 Fast Flux DNS 5
        T1568.003 DNS Calculation 3