RedEchoG1042 ↗
Used dynamic DNS domains associated with malicious infrastructure.1
tfMITRE ATT&CK technique
Dynamic Resolution T1568
- Tactic
- Command and Control
- Platforms
- ESXi, Linux, macOS, Windows
- Version
- 1.1
- Created
- 10 March 2020
- Last modified
- 12 May 2026
- Contributor
- Chris Roffe
Sub-techniques 34 rules across the family · 2 mapped directly to T1568 · 1 of 3 carry rules
Adversaries may dynamically establish connections to command and control infrastructure to evade common detections and remediations. This may be achieved by using malware that shares a common algorithm with the infrastructure the adversary uses to receive the malware's communications. These calculations can be used to dynamically adjust parameters such as the domain name, IP address, or port number the malware uses for command and control.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
8
Threat groupsTop 21%
Threat groups79th percentile · 77% of ATT&CK techniques have fewer threat groups attributed.6
CampaignsTop 7%
Campaigns93rd percentile · 92% of ATT&CK techniques have fewer campaigns recorded.10
Tools & malware74th pct
Tools & malware74th percentile · 73% of ATT&CK techniques have fewer tools implementing them.2
Detection rules50th pct
Detection rules50th percentile · 50% of ATT&CK techniques have more detection rules written.