THREATNOIR
Subscribe
MITRE ATT&CK · T1568

Dynamic Resolution

MITRE · cited in 7 of our lessons

Explanation

What attackers do. Attackers change how their malware finds its command and control servers, for example using fast-changing DNS records or domain generation algorithms, so that blocking a single address or domain does not cut them off. This serves Command and Control.

How to defend. Use protective DNS with threat intelligence, block newly registered domains where acceptable, and collect DNS logs centrally. Analytics that detect algorithmically generated domain names and fast-changing DNS records help. Correlate DNS data with endpoint telemetry so each suspicious lookup can be tied to the process that made it.

Signs to look for. Look for many failed lookups for random-looking domains, domains with very short time to live values and frequently changing addresses, and hosts resolving domains nobody else in the organisation uses. A common gap is not analysing failed DNS lookups at all.

Open the technique on MITRE ATT&CK
The official text
Adversaries may dynamically establish connections to command and control infrastructure to evade common detections and remediations. This may be achieved by using malware that shares a common algorithm with the infrastructure the adversary uses to receive the malware's communications. These calculations can be used to dynamically adjust parameters such as the domain name, IP address, or port number the malware uses for command and control. Adversaries may use dynamic resolution for the purpose of Fallback Channels. When contact is lost with the primary command and control server malware may employ dynamic resolution as a means to reestablishing command and control.

© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation (MITRE ATT&CK®).

Lessons that cite it

Real incidents where this item mattered.