[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:mitre-attack\u002Ft1568":3},{"item":4,"lessons":18,"controls":48,"related":76},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"mitre-attack","t1568","T1568","Dynamic Resolution",7,"MITRE","**What attackers do.** Attackers change how their malware finds its command and control servers, for example using fast-changing DNS records or domain generation algorithms, so that blocking a single address or domain does not cut them off. This serves Command and Control.\n\n**How to defend.** Use protective DNS with threat intelligence, block newly registered domains where acceptable, and collect DNS logs centrally. Analytics that detect algorithmically generated domain names and fast-changing DNS records help. Correlate DNS data with endpoint telemetry so each suspicious lookup can be tied to the process that made it.\n\n**Signs to look for.** Look for many failed lookups for random-looking domains, domains with very short time to live values and frequently changing addresses, and hosts resolving domains nobody else in the organisation uses. A common gap is not analysing failed DNS lookups at all.","Adversaries may dynamically establish connections to command and control infrastructure to evade common detections and remediations. This may be achieved by using malware that shares a common algorithm with the infrastructure the adversary uses to receive the malware's communications. These calculations can be used to dynamically adjust parameters such as the domain name, IP address, or port number the malware uses for command and control.\n\nAdversaries may use dynamic resolution for the purpose of Fallback Channels. When contact is lost with the primary command and control server malware may employ dynamic resolution as a means to reestablishing command and control.","© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation (MITRE ATT&CK®).","https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1568\u002F","Open the technique on MITRE ATT&CK",null,"2026-10-18T15:18:43.663+00:00",{"total":9,"list":19},[20,24,28,32,36,40,44],{"slug":21,"title":22,"published_at":23},"poellm-botnet-exploits-exposed-ai-infrastructure-to-mine-crypto-on-3400-servers","PoeLLM Botnet Exploits Exposed AI Infrastructure to Mine Crypto on 3,400+ Servers","2026-10-07T18:21:48.858+00:00",{"slug":25,"title":26,"published_at":27},"chainscript-rat-uses-blockchain-to-evade-c2-detection","ChainScript RAT Uses Blockchain to Evade C2 Detection","2026-09-21T10:20:42.335+00:00",{"slug":29,"title":30,"published_at":31},"kremlin-banking-malware-hijacks-browsers-to-steal-credentials-via-malicious-extensions","KREMLIN Banking Malware Hijacks Browsers to Steal Credentials via Malicious Extensions","2026-09-15T20:20:46.165+00:00",{"slug":33,"title":34,"published_at":35},"macsync-stealer-uses-rotating-domains-to-evade-detection-on-macos","MacSync Stealer Uses Rotating Domains to Evade Detection on macOS","2026-08-18T20:21:33.916+00:00",{"slug":37,"title":38,"published_at":39},"espionage-framework-abuses-google-services-and-dns-for-covert-c2-communication","Espionage Framework Abuses Google Services and DNS for Covert C2 Communication","2026-08-11T12:21:49.705+00:00",{"slug":41,"title":42,"published_at":43},"doublecup-clickfix-campaign-hides-rat-payloads-in-browser-cache-via-steganographic-pngs","DOUBLECUP ClickFix Campaign Hides RAT Payloads in Browser Cache via Steganographic PNGs","2026-08-04T13:20:39.76+00:00",{"slug":45,"title":46,"published_at":47},"trojanized-webex-zoom-installers-deliver-russian-rat","Trojanized WebEx & Zoom Installers Deliver Russian RAT","2026-07-16T12:21:52.97+00:00",[49,54,59,63,68,72],{"slug":50,"name":51,"problem":52,"stories":53},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",6,{"slug":55,"name":56,"problem":57,"stories":58},"dns-web-filtering","DNS filtering and secure web gateway","Users cannot reach known-malicious sites, and malware cannot phone home.",3,{"slug":60,"name":61,"problem":62,"stories":58},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",{"slug":64,"name":65,"problem":66,"stories":67},"application-allowlisting","Application allowlisting","Any program that reaches a computer can run, including ransomware and the remote-access tools attackers bring with them.",2,{"slug":69,"name":70,"problem":71,"stories":67},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",{"slug":73,"name":74,"problem":75,"stories":67},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[77,82,88,92,97,102,106,110],{"family":78,"item":79,"code":80,"title":81,"together":9},"cis","13","Control 13","Network Monitoring and Defense",{"family":83,"item":84,"code":85,"title":86,"together":87},"nist-csf","de-cm","DE.CM-1","Continuous Monitoring",5,{"family":78,"item":89,"code":90,"title":91,"together":87},"9","Control 9","Email and Web Browser Protections",{"family":93,"item":94,"code":95,"title":96,"together":87},"nist-800-53","si-3","SI-3","Malicious Code Protection",{"family":78,"item":98,"code":99,"title":100,"together":101},"4","Control 4","Secure Configuration of Enterprise Assets and Software",4,{"family":78,"item":103,"code":104,"title":105,"together":101},"2","Control 2","Inventory and Control of Software Assets",{"family":93,"item":107,"code":108,"title":109,"together":101},"sc-7","SC-7","Boundary Protection",{"family":111,"item":112,"code":113,"title":113,"together":58},"itil","overview","ITIL"]