T1637: Dynamic Resolution
Essential information
- MITRE technique ID
T1637- Confidence
- 100/100
- Revoked
- No
- Published
- 05/04/2022 21:57
- Modified
- 27/03/2026 01:41
- Author / Source
- The MITRE Corporation
Platforms
android iOS
Description
Adversaries may dynamically establish connections to command and control infrastructure to evade common detections and remediations. This may be achieved by using malware that shares a common algorithm with the infrastructure the adversary uses to receive the malware's communications. This algorithm can be used to dynamically adjust parameters such as the domain name, IP address, or port number the malware uses for command and control.
Kill chain phases
| Kill chain | Phase |
|---|---|
| mitre-mobile-attack | command-and-control |
Marking (TLP)
Copyright 2015-2025, The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation.