216.73.216.6

T1568: T1568

View on MITRE ATT&CK The MITRE Corporation · Published 10/03/2020 18:28 · Modified 02/04/2026 19:32

Essential information

MITRE technique ID
T1568
Confidence
100/100
Revoked
No
Published
10/03/2020 18:28
Modified
02/04/2026 19:32
Author / Source
The MITRE Corporation

Aliases

Dynamic Resolution

Platforms

windows macos linux ESXi

Description

Adversaries may dynamically establish connections to command and control infrastructure to evade common detections and remediations. This may be achieved by using malware that shares a common algorithm with the infrastructure the adversary uses to receive the malware's communications. These calculations can be used to dynamically adjust parameters such as the domain name, IP address, or port number the malware uses for command and control. Adversaries may use dynamic resolution for the purpose of [Fallback Channels](https://attack.mitre.org/techniques/T1008). When contact is lost with the primary command and control server malware may employ dynamic resolution as a means to reestablishing command and control.(Citation: Talos CCleanup 2017)(Citation: FireEye POSHSPY April 2017)(Citation: ESET Sednit 2017 Activity)

Kill chain phases

Kill chainPhase
mitre-attack command-and-control

Marking (TLP)

TLP:GREEN Copyright 2015-2025, The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation.

External references

Related entities

Intrusion sets, malware, reports, vulnerabilities, indicators and other entities linked to this technique.