THREATNOIR
Subscribe
MITRE ATT&CK · T1583.001

Domains

MITRE · cited in 5 of our lessons

Explanation

What attackers do. Attackers register or buy domain names to use for phishing, malware hosting or command and control, often choosing names that resemble legitimate brands. This serves the Resource Development tactic and happens before any contact with the victim.

How to defend. Monitor newly registered domains and certificate transparency logs for lookalikes of your brand, register common variants of your own domains, and use takedown services. Block newly registered domains at the proxy where feasible, and publish DMARC to protect your own domain from spoofing.

Signs to look for. Look for lookalike domains appearing in certificate logs or emails, and connections to domains only days old. A common gap is that this activity happens outside your network, so it needs external monitoring.

Open the technique on MITRE ATT&CK
The official text
Adversaries may acquire domains that can be used during targeting. Domain names are the human readable names used to represent one or more IP addresses. They can be purchased or, in some cases, acquired for free. Adversaries may use acquired domains for a variety of purposes, including for Phishing, Drive-by Compromise, and Command and Control. Adversaries may choose domains that are similar to legitimate domains, including through use of homoglyphs or use of a different top-level domain (TLD). Typosquatting may be used to aid in delivery of payloads via Drive-by Compromise. Adversaries may also use internationalized domain names (IDNs) and different character sets (e.g. Cyrillic, Greek, etc.) to execute "IDN homograph attacks," creating visually similar lookalike domains used to deliver malware to victim machines. Different URIs/URLs may also be dynamically generated to uniquely serve malicious content to victims (including one-time, single use domain names).

© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation (MITRE ATT&CK®).

Lessons that cite it

Real incidents where this item mattered.