Dynamic Resolution

ID: T1568
Tactics: TA0011 Command and Control
Platforms: ESXi, Linux, macOS, Windows
Data sources: Network Connection Creation, Process Creation, Network Traffic Flow, Network Traffic Content
Source: attack.mitre.org
MITRE last modified: 12 May 2026

Adversaries may dynamically establish connections to command and control infrastructure to evade common detections and remediations. This may be achieved by using malware that shares a common algorithm with the infrastructure the adversary uses to receive the malware's communications. These calculations can be used to dynamically adjust parameters such as the domain name, IP address, or port number the malware uses for command and control.

Adversaries may use dynamic resolution for the purpose of Fallback Channels. When contact is lost with the primary command and control server malware may employ dynamic resolution as a means to reestablishing command and control.^[3]^[4]^[5]

Sub-techniques (3)

Detection

DET0039 Detection Strategy for Dynamic Resolution across OS Platforms
Data components: Network Connection Creation, Process Creation, Network Traffic Flow, Network Traffic Content

Mitigations (2)

M1021 Restrict Web-Based Content: In some cases a local DNS sinkhole may be used to help prevent behaviors associated with dynamic resolution.
M1031 Network Intrusion Prevention: Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level. Malware researchers can reverse engineer malware variants that use dynamic resolution and determine future C2 infrastructure that the malware will attempt to contact, but this is a time and resource intensive effort.^[1]^[2]

Groups (8)

Software (10)

References

Cybereason Dissecting DGAs
Cisco Umbrella DGA Brute Force
Talos CCleanup 2017
FireEye POSHSPY April 2017
ESET Sednit 2017 Activity