MITRE ATT&CKsub-technique

T1568.003 DNS Calculation

Published 2020-03-11 Modified 2026-05-12 Official page ↗
Domain
enterprise
Tactics
Command And Control
Platforms
ESXi, Linux, macOS, Windows
Version
1.1
Created
2020-03-11

Description

Adversaries may perform calculations on addresses returned in DNS results to determine which port and IP address to use for command and control, rather than relying on a predetermined port number or the actual returned IP address. A IP and/or port number calculation can be used to bypass egress filtering on a C2 channel. One implementation of DNS Calculation is to take the first three octets of an IP address in a DNS response and use those values to calculate the port for command and control traffic.

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1568 Dynamic Resolution technique

Tactic · MITRE ATT&CK (1)

  • TA0011 Command and Control tactic

Referenced by MITRE ATT&CK · uses (1)

References