TA505G0092 ↗
Has used fast flux to mask botnets by distributing payloads across multiple IPs.1
- Tactic
- Command and Control
- Platforms
- Linux, macOS, Windows, ESXi
- Version
- 1.1
- Created
- 11 March 2020
- Last modified
- 24 October 2025
Adversaries may use Fast Flux DNS to hide a command and control channel behind an array of rapidly changing IP addresses linked to a single domain resolution. This technique uses a fully qualified domain name, with multiple IP addresses assigned to it which are swapped with high frequency, using a combination of round robin IP addressing and short Time-To-Live (TTL) for a DNS resource record.[1][2][3]
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
3
Threat groups64th pct
Threat groups64th percentile · 64% of ATT&CK techniques have this many threat groups attributed or fewer.0
CampaignsNone recorded
CampaignsNone recorded · 54% of ATT&CK techniques have none either.3
Tools & malware57th pct
Tools & malware57th percentile · 57% of ATT&CK techniques have this many tools implementing them or fewer.0
Detection rulesNone recorded
Detection rulesNone recorded · 33% of ATT&CK techniques have none either.Fast Flux DNS MITRE reference T1568.001
64th pctamong all ATT&CK techniques for number of groups
3 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
Gamaredon GroupG0047 ↗
Has used fast flux DNS to mask their command and control channel behind rotating IP addresses.123 Additionally, Gamaredon Group has used a low-frequency variant of the single-flux method.4
menuPassG0045 ↗
Has used dynamic DNS service providers to host malicious domains.1
All 3 groups for this technique
3 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
AmadeyS1025 ↗
Has used fast flux DNS for its C2.1
njRATS0385 ↗
Has used a fast flux DNS for C2 IP resolution.1
gh0st RATS0032 ↗
Operators have used dynamic DNS to mask the true location of their C2 behind rapidly changing IP addresses.1
All 3 software entries for this technique
Offense vs defense T1568.001
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
Fast Flux DNS detection strategy DET0485
MITRE names one behaviour worth catching for this technique and breaks it into 4 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detection Strategy for Dynamic Resolution using Fast Flux DNS
4 platforms
AN1331 · Windows
Identify repeated DNS resolutions where the same domain name returns multiple IPs in short succession, combined with low TTL values and high query volume from unusual processes. Correlate with process lineage (e.g., Office apps spawning abnormal DNS lookups).
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | WinEventLog:Security | EventCode=1 |
| Network Connection CreationDC0082 | WinEventLog:Sysmon | EventCode=3, 22 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| DNSQueryBurstThreshold | Number of unique IPs returned per domain in a short window |
| TimeWindow | Adjust correlation timeframe for fast flux detection (e.g., 5–10 minutes) |
AN1332 · Linux
Monitor resolver logs and auditd events for domains resolving to a rotating set of IPs within very short TTL intervals. Correlate high query rates from non-browser applications (e.g., python, curl).
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Network Traffic FlowDC0078 | auditd:SYSCALL | socket/connect |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| TTLThreshold | Minimum TTL value considered suspicious (e.g., < 60 seconds) |
| DomainReputationFeed | External TI feed to exclude benign CDN or load balancer behavior |
AN1333 · macOS
Use unified logs to identify processes issuing repeated DNS queries where the resolved IP addresses change frequently within very short TTL values. Correlate with outbound network traffic to validate C2-like patterns.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | macos:unifiedlog | Unexpected apps generating frequent DNS queries |
| Network Traffic FlowDC0078 | macos:unifiedlog | Rapid domain-to-IP resolution changes for same domain |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| DNSRotationRate | Rate of IP churn per domain to trigger detection |
| NewDomainThreshold | Flag if domain was registered recently (e.g., < 30 days) |
AN1334 · ESXi
Monitor ESXi syslog and esxcli outputs for abnormal DNS resolver behavior, such as frequent domain-to-IP changes or unauthorized modifications of DNS settings used by management agents. Correlate domain lookups with short TTL values.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Network Traffic FlowDC0078 | esxi:syslog | Frequent DNS resolution of same domain with rotating IPs |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| ResolverConfigPaths | Whitelist of expected DNS resolvers configured on ESXi |
| ExternalDomainWhitelist | Known trusted external domains for hypervisor services |