T1568 Dynamic Resolution Mappings

Adversaries may dynamically establish connections to command and control infrastructure to evade common detections and remediations. This may be achieved by using malware that shares a common algorithm with the infrastructure the adversary uses to receive the malware's communications. These calculations can be used to dynamically adjust parameters such as the domain name, IP address, or port number the malware uses for command and control.

Adversaries may use dynamic resolution for the purpose of Fallback Channels. When contact is lost with the primary command and control server malware may employ dynamic resolution as a means to reestablishing command and control.(Citation: Talos CCleanup 2017)(Citation: FireEye POSHSPY April 2017)(Citation: ESET Sednit 2017 Activity)



Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name
AC-4 Information Flow Enforcement Protects T1568 Dynamic Resolution
CA-7 Continuous Monitoring Protects T1568 Dynamic Resolution
SC-20 Secure Name/address Resolution Service (authoritative Source) Protects T1568 Dynamic Resolution
SC-21 Secure Name/address Resolution Service (recursive or Caching Resolver) Protects T1568 Dynamic Resolution
SC-22 Architecture and Provisioning for Name/address Resolution Service Protects T1568 Dynamic Resolution
SC-7 Boundary Protection Protects T1568 Dynamic Resolution
SI-3 Malicious Code Protection Protects T1568 Dynamic Resolution
SI-4 System Monitoring Protects T1568 Dynamic Resolution
action.hacking.variety.Use of backdoor or C2 Use of Backdoor or C2 channel related-to T1568 Dynamic Resolution
action.hacking.vector.Backdoor or C2 Backdoor or command and control channel related-to T1568 Dynamic Resolution
action.malware.variety.C2 Command and control (C2) related-to T1568 Dynamic Resolution
action.malware.vector.Download by malware Downloaded and installed by local malware related-to T1568 Dynamic Resolution
amazon_guardduty Amazon GuardDuty technique_scores T1568 Dynamic Resolution

ATT&CK Subtechniques

Technique ID Technique Name Number of Mappings
T1568.003 DNS Calculation 1
T1568.002 Domain Generation Algorithms 10
T1568.001 Fast Flux DNS 1