{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1568","id":"T1568","name":"Dynamic Resolution","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1568","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"4263a051df94426fbdc6715ca9edb23351e1feee4765a6170c81072983850698","description":"Adversaries may dynamically establish connections to command and control infrastructure to evade common detections and remediations. This may be achieved by using malware that shares a common algorithm with the infrastructure the adversary uses to receive the malware's communications. These calculations can be used to dynamically adjust parameters such as the domain name, IP address, or port number the malware uses for command and control.\n\nAdversaries may use dynamic resolution for the purpose of [Fallback Channels](https://attack.mitre.org/techniques/T1008). When contact is lost with the primary command and control server malware may employ dynamic resolution as a means to reestablishing command and control.(Citation: Talos CCleanup 2017)(Citation: FireEye POSHSPY April 2017)(Citation: ESET Sednit 2017 Activity)","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1568","external_id":"T1568"},{"source_name":"Talos CCleanup 2017","description":"Brumaghin, E. et al. (2017, September 18). CCleanup: A Vast Number of Machines at Risk. Retrieved March 9, 2018.","url":"http://blog.talosintelligence.com/2017/09/avast-distributes-malware.html"},{"source_name":"FireEye POSHSPY April 2017","description":"Dunwoody, M.. (2017, April 3). Dissecting One of APT29’s Fileless WMI and PowerShell Backdoors (POSHSPY). Retrieved April 5, 2017.","url":"https://www.fireeye.com/blog/threat-research/2017/03/dissecting_one_ofap.html"},{"source_name":"ESET Sednit 2017 Activity","description":"ESET. (2017, December 21). Sednit update: How Fancy Bear Spent the Year. Retrieved February 18, 2019.","url":"https://www.welivesecurity.com/2017/12/21/sednit-update-fancy-bear-spent-year/"},{"source_name":"Data Driven Security DGA","description":"Jacobs, J. (2014, October 2). Building a DGA Classifier: Part 2, Feature Engineering. Retrieved February 18, 2019.","url":"https://datadrivensecurity.info/blog/posts/2014/Oct/dga-part2/"}],"platforms":["ESXi","Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem","virtualization"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[{"key":"enterprise/T1568.001","id":"T1568.001","name":"Fast Flux DNS","page":"techniques/enterprise/T1568.001/"},{"key":"enterprise/T1568.002","id":"T1568.002","name":"Domain Generation Algorithms","page":"techniques/enterprise/T1568.002/"},{"key":"enterprise/T1568.003","id":"T1568.003","name":"DNS Calculation","page":"techniques/enterprise/T1568.003/"}],"telemetry":[{"id":"DC0082","name":"Network Connection Creation","page":"telemetry/DC0082/","kind":"attack_component","category":"Endpoint activity","description":"Creation of an endpoint network connection linked to a process.","collection_focus":"Enable scoped Sysmon NetworkConnect (3), disabled by default, or a platform-equivalent process-aware network sensor.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["process_guid","destination_ip","destination_port","protocol","initiated"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0082","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","initiated":true}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0085","name":"Network Traffic Content","page":"telemetry/DC0085/","kind":"attack_component","category":"Network and protocol telemetry","description":"Packet or decoded application-protocol content visible at a network sensor.","collection_focus":"Scope approved packet capture/protocol content collection to the lab flow; retain capture provenance and truncation indicators.","providers":[{"name":"Zeek","scope":"Connection and protocol metadata from traffic visible to the sensor.","source_id":"zeek"},{"name":"Suricata EVE","scope":"Configured flow, alert, DNS, HTTP, TLS and protocol records.","source_id":"suricata"}],"configuration":["Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.","Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.","Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection."],"configuration_example":null,"required_fields":["flow_id","protocol","method","path","payload_excerpt"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0085","collector":"illustrative-lab-collector","observation":{"flow_id":"lab-flow-1","protocol":"http","method":"GET","path":"/lab-check","payload_excerpt":"LAB_TELEMETRY_CHECK"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.","sources":[{"id":"zeek","title":"Zeek protocol and connection logs","url":"https://docs.zeek.org/en/current/reference/logs/index.html"},{"id":"zeek_start","title":"Zeek capture setup","url":"https://docs.zeek.org/en/current/quickstart.html"},{"id":"suricata","title":"Suricata EVE JSON output","url":"https://docs.suricata.io/en/latest/output/eve/eve-json-output.html"}],"association":"attack_component","anomaly_design":"Per source and observation point: connection rate, destination-host/port fan-out, response/failure ratio and previously unseen destinations. Compare equivalent time windows; separate authorized scanners, NAT and sampling effects."},{"id":"DC0078","name":"Network Traffic Flow","page":"telemetry/DC0078/","kind":"attack_component","category":"Network and protocol telemetry","description":"Connection/flow summaries such as endpoints, duration, byte counts and transport.","collection_focus":"Collect Zeek conn.log, Suricata flow events or exporter equivalents, including observation point and sampling settings.","providers":[{"name":"Zeek","scope":"Connection and protocol metadata from traffic visible to the sensor.","source_id":"zeek"},{"name":"Suricata EVE","scope":"Configured flow, alert, DNS, HTTP, TLS and protocol records.","source_id":"suricata"},{"name":"AWS VPC Flow Logs","scope":"IP traffic metadata alternative; no packet payload or DNS answer history, and some traffic is not logged.","source_id":"flow"}],"configuration":["Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.","Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.","Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection."],"configuration_example":null,"required_fields":["source_ip","destination_ip","destination_port","protocol","bytes_sent","bytes_received"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0078","collector":"illustrative-lab-collector","observation":{"source_ip":"192.0.2.10","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","bytes_sent":128,"bytes_received":512}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.","sources":[{"id":"zeek","title":"Zeek protocol and connection logs","url":"https://docs.zeek.org/en/current/reference/logs/index.html"},{"id":"zeek_start","title":"Zeek capture setup","url":"https://docs.zeek.org/en/current/quickstart.html"},{"id":"suricata","title":"Suricata EVE JSON output","url":"https://docs.suricata.io/en/latest/output/eve/eve-json-output.html"},{"id":"flow","title":"AWS VPC Flow Logs","url":"https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html"}],"association":"attack_component","anomaly_design":"Per source and observation point: connection rate, destination-host/port fan-out, response/failure ratio and previously unseen destinations. Compare equivalent time windows; separate authorized scanners, NAT and sampling effects."},{"id":"DC0032","name":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component","category":"Endpoint activity","description":"Creation of a process with executable, command line, parent and security context.","collection_focus":"Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":{"label":"Sysmon filter fragment · merge into the reviewed lab configuration","language":"xml","source_id":"sysmon_config","content":"<EventFiltering>\n  <ProcessCreate onmatch=\"include\">\n    <Image condition=\"is\">C:\\Windows\\System32\\whoami.exe</Image>\n  </ProcessCreate>\n</EventFiltering>","note":"This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>."},"required_fields":["process_guid","image","parent_image","command_line","user"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."}],"detection":{"key":"enterprise/T1568","id":"T1568","name":"Dynamic Resolution","domain":"enterprise","platforms":["ESXi","Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem","virtualization"],"source_url":"https://attack.mitre.org/techniques/T1568","technique_page":"techniques/enterprise/T1568/","page":"detections/enterprise/T1568/","status":"rule_source_available","counts":{"sigma":1,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"sigma_rules":[{"id":"195c1119-ef07-4909-bb12-e66f5e07bf3c","title":"Download from Suspicious Dyndns Hosts","status":"test","level":"medium","logsource":{"category":"proxy"},"data_path":"data/detection-rules/195c1119-ef07-4909-bb12-e66f5e07bf3c.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/web/proxy_generic/proxy_download_susp_dyndns.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"}],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0039","name":"Detection Strategy for Dynamic Resolution across OS Platforms","url":"https://attack.mitre.org/detectionstrategies/DET0039","stix_id":"x-mitre-detection-strategy--98d6523f-54c5-4a24-a758-333caa833967","relationship_id":"relationship--d3731f00-2f45-4dc4-9906-7c0f90bf4f06","description":"","analytics":[{"id":"AN0109","name":"Analytic 0109","guidance":"Correlate high-frequency or anomalous DNS query activity with processes that do not normally generate network requests (e.g., Office apps, system utilities). Detect pseudo-random or high-entropy domain lookups indicative of domain generation algorithms (DGAs).","url":"https://attack.mitre.org/detectionstrategies/DET0039#AN0109","platforms":["Windows"],"tuning":[{"field":"EntropyThreshold","description":"Adjust based on environment to differentiate DGAs from legitimate CDNs"},{"field":"TimeWindow","description":"Interval for correlating bursts of DNS queries from the same process"}],"log_sources":[{"component_id":"DC0082","component":"Network Connection Creation","name":"WinEventLog:Sysmon","channel":"EventCode=3, 22","platforms":["Windows"],"analytic_id":"AN0109","source_url":"https://attack.mitre.org/detectionstrategies/DET0039#AN0109","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0082/"},{"component_id":"DC0032","component":"Process Creation","name":"WinEventLog:Sysmon","channel":"EventCode=1","platforms":["Windows"],"analytic_id":"AN0109","source_url":"https://attack.mitre.org/detectionstrategies/DET0039#AN0109","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"}]},{"id":"AN0110","name":"Analytic 0110","guidance":"Monitor /var/log/audit/audit.log and DNS resolver logs for repeated failed lookups or connections to high-entropy domain names. Correlate suspicious DNS queries with process lineage (e.g., Python, bash, or unusual system daemons).","url":"https://attack.mitre.org/detectionstrategies/DET0039#AN0110","platforms":["Linux"],"tuning":[{"field":"DomainReputationFeed","description":"Whitelist/blacklist tuned with external threat intel sources"},{"field":"ProcessWhitelist","description":"Known safe daemons that frequently query domains"}],"log_sources":[{"component_id":"DC0078","component":"Network Traffic Flow","name":"auditd:SYSCALL","channel":"socket/connect","platforms":["Linux"],"analytic_id":"AN0110","source_url":"https://attack.mitre.org/detectionstrategies/DET0039#AN0110","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0078/"},{"component_id":"DC0085","component":"Network Traffic Content","name":"linux:syslog","channel":"Query to suspicious domain with high entropy or low reputation","platforms":["Linux"],"analytic_id":"AN0110","source_url":"https://attack.mitre.org/detectionstrategies/DET0039#AN0110","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0085/"}]},{"id":"AN0111","name":"Analytic 0111","guidance":"Inspect unified logs for anomalous DNS resolutions triggered by non-network applications. Flag repeated connections to newly registered or algorithmically generated domains. Correlate with endpoint process telemetry.","url":"https://attack.mitre.org/detectionstrategies/DET0039#AN0111","platforms":["macOS"],"tuning":[{"field":"NewDomainThreshold","description":"Age of domain registration considered suspicious (e.g., < 30 days)"},{"field":"DNSQueryVolume","description":"Number of queries per process per time window"}],"log_sources":[{"component_id":"DC0085","component":"Network Traffic Content","name":"macos:unifiedlog","channel":"DNS query with pseudo-random subdomain patterns","platforms":["macOS"],"analytic_id":"AN0111","source_url":"https://attack.mitre.org/detectionstrategies/DET0039#AN0111","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0085/"},{"component_id":"DC0032","component":"Process Creation","name":"macos:unifiedlog","channel":"Unexpected applications generating outbound DNS queries","platforms":["macOS"],"analytic_id":"AN0111","source_url":"https://attack.mitre.org/detectionstrategies/DET0039#AN0111","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"}]},{"id":"AN0112","name":"Analytic 0112","guidance":"Monitor esxcli and syslog records for DNS resolver changes or repeated queries to unusual external domains by management agents. Detect unauthorized changes to VM or host network settings that redirect DNS lookups.","url":"https://attack.mitre.org/detectionstrategies/DET0039#AN0112","platforms":["ESXi"],"tuning":[{"field":"ResolverConfigPaths","description":"Expected resolvers or DNS forwarders in ESXi configurations"},{"field":"ExternalDomainWhitelist","description":"Set of trusted external domains expected for ESXi host activity"}],"log_sources":[{"component_id":"DC0078","component":"Network Traffic Flow","name":"esxi:syslog","channel":"esxcli network vswitch or DNS resolver configuration updates","platforms":["ESXi"],"analytic_id":"AN0112","source_url":"https://attack.mitre.org/detectionstrategies/DET0039#AN0112","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0078/"}]}]}],"telemetry_references":[{"id":"DC0082","name":"Network Connection Creation","tag":"Network Connection Creation","page":"telemetry/DC0082/","kind":"attack_component"},{"id":"DC0085","name":"Network Traffic Content","tag":"Network Traffic Content","page":"telemetry/DC0085/","kind":"attack_component"},{"id":"DC0078","name":"Network Traffic Flow","tag":"Network Traffic Flow","page":"telemetry/DC0078/","kind":"attack_component"},{"id":"DC0032","name":"Process Creation","tag":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[{"id":"S1087","name":"AsyncRAT","page":"tools/S1087/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0332","name":"Remcos","page":"tools/S0332/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[{"id":"S1087","name":"AsyncRAT","page":"tools/S1087/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0332","name":"Remcos","page":"tools/S0332/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"software":[{"id":"S0034","name":"NETEAGLE","url":"https://attack.mitre.org/software/S0034","kind":"malware","description":"[NETEAGLE](https://attack.mitre.org/software/S0034) can use HTTP to download resources that contain an IP address and port number pair to connect to for C2.(Citation: FireEye APT30)","relationship_id":"relationship--406afc1a-4ea7-45c5-b137-7784f9ed53f3","references":[{"source_name":"FireEye APT30","description":"FireEye Labs. (2015, April). APT30 AND THE MECHANICS OF A LONG-RUNNING CYBER ESPIONAGE OPERATION. Retrieved November 17, 2024.","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2015/05/20081935/rpt-apt30.pdf"}]},{"id":"S0148","name":"RTM","url":"https://attack.mitre.org/software/S0148","kind":"malware","description":"[RTM](https://attack.mitre.org/software/S0148) has resolved [Pony](https://attack.mitre.org/software/S0453) C2 server IP addresses by either converting Bitcoin blockchain transaction data to specific octets, or accessing IP addresses directly within the Namecoin blockchain.(Citation: CheckPoint Redaman October 2019)(Citation: Unit42 Redaman January 2019)","relationship_id":"relationship--25eb9cd3-80e1-4116-bfd3-fa3819dc2079","references":[{"source_name":"CheckPoint Redaman October 2019","description":"Eisenkraft, K., Olshtein, A. (2019, October 17). Pony’s C&C servers hidden inside the Bitcoin blockchain. Retrieved June 15, 2020.","url":"https://research.checkpoint.com/2019/ponys-cc-servers-hidden-inside-the-bitcoin-blockchain/"},{"source_name":"Unit42 Redaman January 2019","description":"Duncan, B., Harbison, M. (2019, January 23). Russian Language Malspam Pushing Redaman Banking Malware. Retrieved June 16, 2020.","url":"https://unit42.paloaltonetworks.com/russian-language-malspam-pushing-redaman-banking-malware/"}]},{"id":"S0268","name":"Bisonal","url":"https://attack.mitre.org/software/S0268","kind":"malware","description":"[Bisonal](https://attack.mitre.org/software/S0268) has used a dynamic DNS service for C2.(Citation: Talos Bisonal Mar 2020)","relationship_id":"relationship--e101388f-ea73-4d02-b07f-c89a17dfa4a5","references":[{"source_name":"Talos Bisonal Mar 2020","description":"Mercer, W., et al. (2020, March 5). Bisonal: 10 years of play. Retrieved January 26, 2022.","url":"https://blog.talosintelligence.com/2020/03/bisonal-10-years-of-play.html"}]},{"id":"S0332","name":"Remcos","url":"https://attack.mitre.org/software/S0332","kind":"tool","description":"[Remcos](https://attack.mitre.org/software/S0332) has used dynamic DNS domains in C2 communications.(Citation: Check Point Blind Eagle MAR 2025)","relationship_id":"relationship--c3f01b1a-82c8-416c-9416-6b8469c89e65","references":[{"source_name":"Check Point Blind Eagle MAR 2025","description":"Check Point Research. (2025, March 10). Blind Eagle: …And Justice for All. Retrieved April 16, 2026.","url":"https://research.checkpoint.com/2025/blind-eagle-and-justice-for-all/"}]},{"id":"S0449","name":"Maze","url":"https://attack.mitre.org/software/S0449","kind":"malware","description":"[Maze](https://attack.mitre.org/software/S0449) has forged POST strings with a random choice from a list of possibilities including \"forum\", \"php\", \"view\", etc. while making connection with the C2, hindering detection efforts.(Citation: McAfee Maze March 2020)","relationship_id":"relationship--6a521aa4-d389-4ef4-bd24-442d8af23333","references":[{"source_name":"McAfee Maze March 2020","description":"Mundo, A. (2020, March 26). Ransomware Maze. Retrieved May 18, 2020.","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/ransomware-maze/"}]},{"id":"S0559","name":"SUNBURST","url":"https://attack.mitre.org/software/S0559","kind":"malware","description":"[SUNBURST](https://attack.mitre.org/software/S0559) dynamically resolved C2 infrastructure for randomly-generated subdomains within a parent domain.(Citation: FireEye SUNBURST Backdoor December 2020)","relationship_id":"relationship--f974cb59-0c30-43a3-bb3e-58ebc1007d6d","references":[{"source_name":"FireEye SUNBURST Backdoor December 2020","description":"FireEye. (2020, December 13). Highly Evasive Attacker Leverages SolarWinds Supply Chain to Compromise Multiple Global Victims With SUNBURST Backdoor. Retrieved January 4, 2021.","url":"https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html"}]},{"id":"S0666","name":"Gelsemium","url":"https://attack.mitre.org/software/S0666","kind":"malware","description":"[Gelsemium](https://attack.mitre.org/software/S0666) can use dynamic DNS domain names in C2.(Citation: ESET Gelsemium June 2021)","relationship_id":"relationship--0869b511-3211-4f90-86fa-d145fa42cc3a","references":[{"source_name":"ESET Gelsemium June 2021","description":"Dupuy, T. and Faou, M. (2021, June). Gelsemium. Retrieved November 30, 2021.","url":"https://www.welivesecurity.com/wp-content/uploads/2021/06/eset_gelsemium.pdf"}]},{"id":"S0671","name":"Tomiris","url":"https://attack.mitre.org/software/S0671","kind":"malware","description":"[Tomiris](https://attack.mitre.org/software/S0671) has connected to a signalization server that provides a URL and port, and then [Tomiris](https://attack.mitre.org/software/S0671) sends a GET request to that URL to establish C2.(Citation: Kaspersky Tomiris Sep 2021)","relationship_id":"relationship--03f288cd-a189-4de9-abd4-6b10bda138a4","references":[{"source_name":"Kaspersky Tomiris Sep 2021","description":"Kwiatkoswki, I. and Delcher, P. (2021, September 29). DarkHalo After SolarWinds: the Tomiris connection. Retrieved December 27, 2021.","url":"https://securelist.com/darkhalo-after-solarwinds-the-tomiris-connection/104311/"}]},{"id":"S1087","name":"AsyncRAT","url":"https://attack.mitre.org/software/S1087","kind":"tool","description":"[AsyncRAT](https://attack.mitre.org/software/S1087) can be configured to use dynamic DNS.(Citation: AsyncRAT GitHub)","relationship_id":"relationship--6a56f549-3835-4f1f-8ece-fb8400f04432","references":[{"source_name":"AsyncRAT GitHub","description":"Nyan-x-Cat. (n.d.). NYAN-x-CAT / AsyncRAT-C-Sharp. Retrieved October 3, 2023.","url":"https://github.com/NYAN-x-CAT/AsyncRAT-C-Sharp/blob/master/README.md"}]},{"id":"S9015","name":"BRICKSTORM","url":"https://attack.mitre.org/software/S9015","kind":"malware","description":"[BRICKSTORM](https://attack.mitre.org/software/S9015) has utilized DNS services sslip.io and nip.io to resolve C2 IP addresses.(Citation: Google BRICKSTORM September 2025)  ","relationship_id":"relationship--b804627f-f89d-442d-bcea-15c21b1508b6","references":[{"source_name":"Google BRICKSTORM September 2025","description":"Sarah Yoder, John Wolfram, Ashley Pearson, Doug Bienstock, Josh Madeley, Josh Murchie, Brad Slaybaugh, Matt Lin, Geoff Carstairs, Austin Larsen. (2025, September 24). Another BRICKSTORM: Stealthy Backdoor Enabling Espionage into Tech and Legal Sectors. Retrieved April 16, 2026.","url":"https://cloud.google.com/blog/topics/threat-intelligence/brickstorm-espionage-campaign"}]}],"actors":[{"id":"G0016","name":"APT29","url":"https://attack.mitre.org/groups/G0016","kind":"intrusion-set","description":"[APT29](https://attack.mitre.org/groups/G0016) has used Dynamic DNS providers for their malware C2 infrastructure.(Citation: Mandiant APT29 Eye Spy Email Nov 22)","relationship_id":"relationship--2c57efb7-0a7a-4b75-bbe1-e6f243713bee","references":[{"source_name":"Mandiant APT29 Eye Spy Email Nov 22","description":"Mandiant. (2022, May 2). UNC3524: Eye Spy on Your Email. Retrieved August 17, 2023.","url":"https://www.mandiant.com/resources/blog/unc3524-eye-spy-email"}]},{"id":"G0047","name":"Gamaredon Group","url":"https://attack.mitre.org/groups/G0047","kind":"intrusion-set","description":"[Gamaredon Group](https://attack.mitre.org/groups/G0047) has incorporated dynamic DNS domains in its infrastructure.(Citation: Unit 42 Gamaredon February 2022)","relationship_id":"relationship--eb77b635-6f00-4975-b36e-63c7a5c48e3c","references":[{"source_name":"Unit 42 Gamaredon February 2022","description":"Unit 42. (2022, February 3). Russia’s Gamaredon aka Primitive Bear APT Group Actively Targeting Ukraine. Retrieved February 21, 2022.","url":"https://unit42.paloaltonetworks.com/gamaredon-primitive-bear-ukraine-update-2021/"}]},{"id":"G0094","name":"Kimsuky","url":"https://attack.mitre.org/groups/G0094","kind":"intrusion-set","description":"[Kimsuky](https://attack.mitre.org/groups/G0094) has used Dynamic DNS (DDNS) services, such as FreeDNS or No-IP DDNS, to include servers located in South Korea.(Citation: NaumaanProofpoint_GlobalClickFix_April2025)","relationship_id":"relationship--74554e53-92bd-4707-8e1a-ae3904ec935e","references":[{"source_name":"NaumaanProofpoint_GlobalClickFix_April2025","description":"Naumaan, S., et al. (2025, April 17). Around the World in 90 Days: State-Sponsored Actors Try ClickFix . Retrieved January 21, 2026.","url":"https://www.proofpoint.com/us/blog/threat-insight/around-world-90-days-state-sponsored-actors-try-clickfix"}]},{"id":"G0099","name":"APT-C-36","url":"https://attack.mitre.org/groups/G0099","kind":"intrusion-set","description":"[APT-C-36](https://attack.mitre.org/groups/G0099) has used DDNS services such as DuckDNS, noip[.]com, and con-ip[.]com to redirect victims to sites or repositories hosting malware implants.(Citation: Kaspersky BlindEagle AUG 2024)(Citation: Check Point Blind Eagle MAR 2025)(Citation: LevelBlue Blind Eagle Proton66 JUN 2025)(Citation: Recorded Future TAG-144 AUG 2025)(Citation: Zscaler BlindEagle DEC 2025)","relationship_id":"relationship--d7647e3e-d554-44e0-97e0-b8d5abab3cab","references":[{"source_name":"Check Point Blind Eagle MAR 2025","description":"Check Point Research. (2025, March 10). Blind Eagle: …And Justice for All. Retrieved April 16, 2026.","url":"https://research.checkpoint.com/2025/blind-eagle-and-justice-for-all/"},{"source_name":"Kaspersky BlindEagle AUG 2024","description":"Global Research & Analysis Team, Kaspersky. (2024, August 19). BlindEagle flying high in Latin America. Retrieved April 16, 2026.","url":"https://securelist.com/blindeagle-apt/113414/"},{"source_name":"Recorded Future TAG-144 AUG 2025","description":"Insikt Group. (2025, August 26). TAG-144’s Persistent Grip on South American Organizations. Retrieved April 16, 2026.","url":"https://assets.recordedfuture.com/insikt-report-pdfs/2025/cta-2025-0826.pdf"},{"source_name":"LevelBlue Blind Eagle Proton66 JUN 2025","description":"Melnyk, S. (2025, June 27). Tracing Blind Eagle to Proton66. Retrieved April 16, 2026.","url":"https://www.levelblue.com/blogs/spiderlabs-blog/tracing-blind-eagle-to-proton66/"},{"source_name":"Zscaler BlindEagle DEC 2025","description":"Pellegrino, G. (2025, December 16). BlindEagle Targets Colombian Government Agency with Caminho and DCRAT. Retrieved April 16, 2026.","url":"https://www.zscaler.com/blogs/security-research/blindeagle-targets-colombian-government-agency-caminho-and-dcrat"}]},{"id":"G0134","name":"Transparent Tribe","url":"https://attack.mitre.org/groups/G0134","kind":"intrusion-set","description":"[Transparent Tribe](https://attack.mitre.org/groups/G0134) has used dynamic DNS services to set up C2.(Citation: Proofpoint Operation Transparent Tribe March 2016)","relationship_id":"relationship--23041edc-3136-49b7-8d08-311321455aa7","references":[{"source_name":"Proofpoint Operation Transparent Tribe March 2016","description":"Huss, D. (2016, March 1). Operation Transparent Tribe. Retrieved June 8, 2016.","url":"https://www.proofpoint.com/sites/default/files/proofpoint-operation-transparent-tribe-threat-insight-en.pdf"}]},{"id":"G1002","name":"BITTER","url":"https://attack.mitre.org/groups/G1002","kind":"intrusion-set","description":"[BITTER](https://attack.mitre.org/groups/G1002) has used DDNS for C2 communications.(Citation: Forcepoint BITTER Pakistan Oct 2016)","relationship_id":"relationship--24fadb92-7a18-450b-b4ca-f5dd019ce54c","references":[{"source_name":"Forcepoint BITTER Pakistan Oct 2016","description":"Dela Paz, R. (2016, October 21). BITTER: a targeted attack against Pakistan. Retrieved June 1, 2022.","url":"https://www.forcepoint.com/blog/x-labs/bitter-targeted-attack-against-pakistan"}]},{"id":"G1018","name":"TA2541","url":"https://attack.mitre.org/groups/G1018","kind":"intrusion-set","description":"[TA2541](https://attack.mitre.org/groups/G1018) has used dynamic DNS services for C2 infrastructure.(Citation: Proofpoint TA2541 February 2022)","relationship_id":"relationship--20e1f501-0932-40d2-a41b-386a8b9d463d","references":[{"source_name":"Proofpoint TA2541 February 2022","description":"Larson, S. and Wise, J. (2022, February 15). Charting TA2541's Flight. Retrieved September 12, 2023.","url":"https://www.proofpoint.com/us/blog/threat-insight/charting-ta2541s-flight"}]},{"id":"G1042","name":"RedEcho","url":"https://attack.mitre.org/groups/G1042","kind":"intrusion-set","description":"[RedEcho](https://attack.mitre.org/groups/G1042) used dynamic DNS domains associated with malicious infrastructure.(Citation: RecordedFuture RedEcho 2021)","relationship_id":"relationship--067b9dbb-a5fc-4d41-9dcb-ee909e0938f7","references":[{"source_name":"RecordedFuture RedEcho 2021","description":"Recorded Future Insikt Group. (2021, February). China-Linked Group RedEcho Targets the Indian Power Sector Amid Heightened Border Tensions. Retrieved November 21, 2024.","url":"https://go.recordedfuture.com/hubfs/reports/cta-2021-0228.pdf"}]}],"mitigations":[{"id":"M1021","name":"Restrict Web-Based Content","url":"https://attack.mitre.org/mitigations/M1021","kind":"course-of-action","description":"In some cases a local DNS sinkhole may be used to help prevent behaviors associated with dynamic resolution.","relationship_id":"relationship--5632a2de-e231-4ef0-971b-6cdb2750d410","references":[]},{"id":"M1031","name":"Network Intrusion Prevention","url":"https://attack.mitre.org/mitigations/M1031","kind":"course-of-action","description":"Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level. Malware researchers can reverse engineer malware variants that use dynamic resolution and determine future C2 infrastructure that the malware will attempt to contact, but this is a time and resource intensive effort.(Citation: Cybereason Dissecting DGAs)(Citation: Cisco Umbrella DGA Brute Force)","relationship_id":"relationship--0c2dadcb-36c4-4255-a53d-e54f1bb71c5f","references":[{"source_name":"Cybereason Dissecting DGAs","description":"Sternfeld, U. (2016). Dissecting Domain Generation Algorithms: Eight Real World DGA Variants. Retrieved February 18, 2019.","url":"http://go.cybereason.com/rs/996-YZT-709/images/Cybereason-Lab-Analysis-Dissecting-DGAs-Eight-Real-World-DGA-Variants.pdf"},{"source_name":"Cisco Umbrella DGA Brute Force","description":"Kasza, A. (2015, February 18). Using Algorithms to Brute Force Algorithms. Retrieved February 18, 2019.","url":"https://umbrella.cisco.com/blog/2015/02/18/at-high-noon-algorithms-do-battle/"}]}],"candidates":[],"simulation":{"atomic_status":"no_atomic_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1008":"/ttp-simulation/techniques/enterprise/T1008/","T1568":"/ttp-simulation/techniques/enterprise/T1568/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1568","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0082","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","initiated":true}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0085","collector":"illustrative-lab-collector","observation":{"flow_id":"lab-flow-1","protocol":"http","method":"GET","path":"/lab-check","payload_excerpt":"LAB_TELEMETRY_CHECK"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0078","collector":"illustrative-lab-collector","observation":{"source_ip":"192.0.2.10","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","bytes_sent":128,"bytes_received":512}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}}]}}