Adversaries may dynamically establish connections to command and control infrastructure to evade common detections and remediations. This may be achieved by using malware that shares a common algorithm with the infrastructure the adversary uses to receive the malware's communications. These calculations can be used to dynamically adjust parameters such as the domain name, IP address, or port number the malware uses for command and control.
Adversaries may use dynamic resolution for the purpose of Fallback Channels. When contact is lost with the primary command and control server malware may employ dynamic resolution as a means to reestablishing command and control.(Citation: Talos CCleanup 2017)(Citation: FireEye POSHSPY April 2017)(Citation: ESET Sednit 2017 Activity)
View in MITRE ATT&CK®Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
---|---|---|---|---|---|
AC-4 | Information Flow Enforcement | Protects | T1568 | Dynamic Resolution | |
CA-7 | Continuous Monitoring | Protects | T1568 | Dynamic Resolution | |
SC-20 | Secure Name/address Resolution Service (authoritative Source) | Protects | T1568 | Dynamic Resolution | |
SC-21 | Secure Name/address Resolution Service (recursive or Caching Resolver) | Protects | T1568 | Dynamic Resolution | |
SC-22 | Architecture and Provisioning for Name/address Resolution Service | Protects | T1568 | Dynamic Resolution | |
SC-7 | Boundary Protection | Protects | T1568 | Dynamic Resolution | |
SI-3 | Malicious Code Protection | Protects | T1568 | Dynamic Resolution | |
SI-4 | System Monitoring | Protects | T1568 | Dynamic Resolution |
Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
---|---|---|---|---|---|
action.hacking.variety.Use of backdoor or C2 | Use of Backdoor or C2 channel | related-to | T1568 | Dynamic Resolution | |
action.hacking.vector.Backdoor or C2 | Backdoor or command and control channel | related-to | T1568 | Dynamic Resolution | |
action.malware.variety.C2 | Command and control (C2) | related-to | T1568 | Dynamic Resolution | |
action.malware.vector.Download by malware | Downloaded and installed by local malware | related-to | T1568 | Dynamic Resolution |
Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
---|---|---|---|---|---|
amazon_guardduty | Amazon GuardDuty | technique_scores | T1568 | Dynamic Resolution |
Comments
GuardDuty has the following finding types to flag events where adversaries may dynamically establish connections to command-and-control infrastructure to evade common detections and remediations.
Trojan:EC2/DGADomainRequest.B Trojan:EC2/DGADomainRequest.C!DNS
References
|
Technique ID | Technique Name | Number of Mappings |
---|---|---|
T1568.003 | DNS Calculation | 1 |
T1568.002 | Domain Generation Algorithms | 10 |
T1568.001 | Fast Flux DNS | 1 |