MITRE ATT&CKtechnique

T1568 Dynamic Resolution

Published 2020-03-10 Modified 2026-05-12 Official page ↗
Domain
enterprise
Tactics
Command And Control
Platforms
ESXi, Linux, macOS, Windows
Version
1.1
Created
2020-03-10

Description

Adversaries may dynamically establish connections to command and control infrastructure to evade common detections and remediations. This may be achieved by using malware that shares a common algorithm with the infrastructure the adversary uses to receive the malware's communications. These calculations can be used to dynamically adjust parameters such as the domain name, IP address, or port number the malware uses for command and control. Adversaries may use dynamic resolution for the purpose of Fallback Channels. When contact is lost with the primary command and control server malware may employ dynamic resolution as a means to reestablishing command and control.

Related

Tactic · MITRE ATT&CK (1)

  • TA0011 Command and Control tactic

Referenced by MITRE ATT&CK · mitigates (2)

  • M1031 Network Intrusion Prevention mitigation
  • M1021 Restrict Web-Based Content mitigation

Referenced by MITRE ATT&CK · subtechnique of (3)

Referenced by MITRE ATT&CK · uses (24)

  • S9015 BRICKSTORM software (malware)
  • C0043 Indian Critical Infrastructure Intrusions campaign
  • G1042 RedEcho group
  • S1087 AsyncRAT software (tool)
  • G1018 TA2541 group
  • C0026 C0026 campaign
  • C0024 SolarWinds Compromise campaign
  • C0016 Operation Dust Storm campaign
  • C0005 Operation Spalax campaign
  • C0002 Night Dragon campaign
  • G1002 BITTER group
  • S0671 Tomiris software (malware)
  • S0666 Gelsemium software (malware)
  • G0134 Transparent Tribe group
  • S0559 SUNBURST software (malware)
  • S0449 Maze software (malware)
  • G0099 APT-C-36 group
  • G0094 Kimsuky group
  • S0332 Remcos software (tool)
  • S0268 Bisonal software (malware)
  • G0016 APT29 group
  • G0047 Gamaredon Group group
  • S0034 NETEAGLE software (malware)
  • S0148 RTM software (malware)

Referenced by Compliance · mitigates (11)

  • CIS-13.10 Perform Application Layer Filtering CIS Safeguard v8.1
  • CIS-13.8 Deploy a Network Intrusion Prevention Solution CIS Safeguard v8.1
  • CIS-9.2 Use DNS Filtering Services CIS Safeguard v8.1
  • NIST-AC-4 Information Flow Enforcement NIST 800-53 control
  • NIST-CA-7 Continuous Monitoring NIST 800-53 control
  • NIST-SC-20 Secure Name/Address Resolution Service (Authoritative Source) NIST 800-53 control
  • NIST-SC-21 Secure Name/Address Resolution Service (Recursive or Caching Resolver) NIST 800-53 control
  • NIST-SC-22 Architecture and Provisioning for Name/Address Resolution Service NIST 800-53 control
  • NIST-SC-7 Boundary Protection NIST 800-53 control
  • NIST-SI-3 Malicious Code Protection NIST 800-53 control
  • NIST-SI-4 System Monitoring NIST 800-53 control

References