MITRE ATT&CK technique · Command and Control

`T1568` Dynamic Resolution

Adversaries may dynamically establish connections to command and control infrastructure to evade common detections and remediations. This may be achieved by using malware that shares a common algorithm with the infrastructure the adversary uses to receive the malware's communications. These calculations can be used to dynamically adjust parameters such as the domain name, IP address, or port…

MITRE ATT&CK page ↗

Who uses it · with stories on Jábega

Amadey

Sigma rules to hunt it

Communication To Ngrok Tunneling Service - Linuxhightest · linux
Communication To Ngrok Tunneling Service Initiatedhightest · windows
Axios NPM Compromise Malicious C2 Domain DNS Queryhighexperimental · dns
Download from Suspicious Dyndns Hostsmediumtest · proxy

Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.