tfMITRE ATT&CK technique

Dynamic Resolution T1568

Tactic: Command and Control
Platforms: ESXi, Linux, macOS, Windows
Version: 1.1
Created: 10 March 2020
Last modified: 12 May 2026
Contributor: Chris Roffe

Sub-techniques 34 rules across the family · 2 mapped directly to T1568 · 1 of 3 carry rules

.001Fast Flux DNS0 .002Domain Generation Algorithms2 .003DNS Calculation0

Adversaries may dynamically establish connections to command and control infrastructure to evade common detections and remediations. This may be achieved by using malware that shares a common algorithm with the infrastructure the adversary uses to receive the malware's communications. These calculations can be used to dynamically adjust parameters such as the domain name, IP address, or port number the malware uses for command and control.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsTop 21%

Threat groups79th percentile · 79% of ATT&CK techniques have this many threat groups attributed or fewer.

CampaignsTop 7%

Campaigns93rd percentile · 93% of ATT&CK techniques have this many campaigns recorded or fewer.

Tools & malware74th pct

Tools & malware74th percentile · 74% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rules50th pct

Detection rules50th percentile · 50% of ATT&CK techniques have more detection rules written.

Dynamic Resolution MITRE reference T1568

Top 21%of all ATT&CK techniques for number of groups

8 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

RedEchoG1042 ↗

Used dynamic DNS domains associated with malicious infrastructure.1

created 2024-11-211 reference

TA2541G1018 ↗

Has used dynamic DNS services for C2 infrastructure.1

created 2023-09-121 reference

BITTERG1002 ↗

Has used DDNS for C2 communications.1

created 2022-06-011 referenceaka T-APT-17

Transparent TribeG0134 ↗

Has used dynamic DNS services to set up C2.1

created 2021-09-021 referenceaka COPPER FIELDSTONE

APT-C-36G0099 ↗

Has used DDNS services such as DuckDNS, noip[.]com, and con-ip[.]com to redirect victims to sites or repositories hosting malware implants.1 2 3 4 5

created 2020-05-055 referencesaka Blind Eagle

KimsukyG0094 ↗

Has used Dynamic DNS (DDNS) services, such as FreeDNS or No-IP DDNS, to include servers located in South Korea.1

created 2019-08-261 referenceaka Black Banshee

All 8 groups for this technique · 6 newest in this preview

Offense vs defense T1568

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 5Sigma rules (cumulative) · 2Splunk ESCU (cumulative) · 0

first rule: 2017 Q4 · 5 of 6 campaigns plotted (Night Dragon (dated 2009) falls before the 2014 window)

Dynamic Resolution detection strategy DET0039

MITRE names one behaviour worth catching for this technique and breaks it into 4 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection Strategy for Dynamic Resolution across OS Platforms

Enterprise

4 platforms

AN0109 · Windows

Correlate high-frequency or anomalous DNS query activity with processes that do not normally generate network requests (e.g., Office apps, system utilities). Detect pseudo-random or high-entropy domain lookups indicative of domain generation algorithms (DGAs).

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
Network Connection CreationDC0082	WinEventLog:Sysmon	EventCode=3, 22

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
EntropyThreshold	Adjust based on environment to differentiate DGAs from legitimate CDNs
TimeWindow	Interval for correlating bursts of DNS queries from the same process

AN0110 · Linux

Monitor /var/log/audit/audit.log and DNS resolver logs for repeated failed lookups or connections to high-entropy domain names. Correlate suspicious DNS queries with process lineage (e.g., Python, bash, or unusual system daemons).

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Network Traffic FlowDC0078	auditd:SYSCALL	socket/connect
Network Traffic ContentDC0085	linux:syslog	Query to suspicious domain with high entropy or low reputation

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
DomainReputationFeed	Whitelist/blacklist tuned with external threat intel sources
ProcessWhitelist	Known safe daemons that frequently query domains

AN0111 · macOS

Inspect unified logs for anomalous DNS resolutions triggered by non-network applications. Flag repeated connections to newly registered or algorithmically generated domains. Correlate with endpoint process telemetry.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	macos:unifiedlog	Unexpected applications generating outbound DNS queries
Network Traffic ContentDC0085	macos:unifiedlog	DNS query with pseudo-random subdomain patterns

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
NewDomainThreshold	Age of domain registration considered suspicious (e.g., < 30 days)
DNSQueryVolume	Number of queries per process per time window

AN0112 · ESXi

Monitor esxcli and syslog records for DNS resolver changes or repeated queries to unusual external domains by management agents. Detect unauthorized changes to VM or host network settings that redirect DNS lookups.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Network Traffic FlowDC0078	esxi:syslog	esxcli network vswitch or DNS resolver configuration updates

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ResolverConfigPaths	Expected resolvers or DNS forwarders in ESXi configurations
ExternalDomainWhitelist	Set of trusted external domains expected for ESXi host activity

Dynamic Resolution detections T1568

2 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

50th pctamong all ATT&CK techniques for number of rules

Product

(none) 2

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs