自动化接入 · API / MCP EN

技术说明 · T1568

Dynamic Resolution

Adversaries may dynamically establish connections to command and control infrastructure to evade common detections and remediations. This may be achieved by using malware that shares a common algorithm with the infrastructure the adversary uses to receive the malware's communications. These calculations can be used to dynamically adjust parameters such as the domain name, IP address, or port number the malware uses for command and control. Adversaries may use dynamic resolution for the purpose of Fallback Channels. When contact is lost with the primary command and control server malware may employ dynamic resolution as a means to reestablishing command and control.

ATT&CK T1568 platforms — 状态 有效 版本 20.1

Adversaries may dynamically establish connections to command and control infrastructure to evade common detections and remediations. This may be achieved by using malware that shares a common algorithm with the infrastructure the adversary uses to receive the malware's communications. These calculations can be used to dynamically adjust parameters such as the domain name, IP address, or port number the malware uses for command and control. Adversaries may use dynamic resolution for the purpose of Fallback Channels. When contact is lost with the primary command and control server malware may employ dynamic resolution as a means to reestablishing command and control.123

  1. Talos CCleanup 2017
  2. FireEye POSHSPY April 2017
  3. ESET Sednit 2017 Activity

使用该技术的组织

组织名称国家
grp_g1042RedEcho—
grp_g0134Transparent TribePakistan
grp_g1018TA2541—
grp_g0099APT-C-36—
grp_g0047Gamaredon GroupRussia
grp_g0094KimsukyDPRK
grp_g0016APT29Russia
grp_g1002BITTERPakistan

断言

尚无指向该技术的公开断言。

记录自动入库·未人工复核；置信度与有效期按引用读取。