Dynamic Resolution: DNS Calculation
- ID
- T1568.003
- Tactics
- TA0011 Command and Control
- Sub-technique of
- T1568 Dynamic Resolution
- Platforms
- ESXi, Linux, macOS, Windows
- Data sources
- Network Connection Creation, Process Creation, Network Traffic Content, Network Traffic Flow
- Source
- attack.mitre.org
- MITRE last modified
- 12 May 2026
Adversaries may perform calculations on addresses returned in DNS results to determine which port and IP address to use for command and control, rather than relying on a predetermined port number or the actual returned IP address. A IP and/or port number calculation can be used to bypass egress filtering on a C2 channel.[1]
One implementation of DNS Calculation is to take the first three octets of an IP address in a DNS response and use those values to calculate the port for command and control traffic.[1][2][3]
Detection
- DET0262 Detection Strategy for Dynamic Resolution through DNS Calculation
Data components: Network Connection Creation, Process Creation, Network Traffic Content, Network Traffic Flow