Dynamic Resolution T1568

Tactic: Command & Control

Adversaries may dynamically establish connections to command and control infrastructure to evade common detections and remediations. This may be achieved by using malware that shares a common algorithm with the infrastructure the adversary uses to receive the malware's communications. These calculations can be used to dynamically adjust parameters such as the domain name, IP address, or port number the malware uses for command and control.

Events covered

10 catalog events are tagged with this technique by at least one rule.

Authoring guide

Patterns shared across the 34 rules above: which fields they filter on, what specific values they look for, and what they exclude. The catalog normalizes field names across vendors so Sigma's Image, Elastic's process.name, and Splunk's process_name collapse into one row. Each rule contributes at most once per row.

Fields filtered most (60 distinct)

The fields most rules look at when detecting this technique. The How column shows the operators authors use (eq, wildcard, regex_match, match) and how often each appears. Sample values are concrete examples to start from, not an exhaustive list.

FieldRulesHowSample values
count_5gt 51, 200, 25
DestinationHostname4contains 2, regex_match 2tunnel.ap.ngrok.com, tunnel.au.ngrok.com, tunnel.eu.ngrok.com, [a-z]{3}.stage.[0-9]{8}\..*, [a-za-z]{4,5}\.(pw|us|club|info|site|top)
DestinationPortName3in 2, eq 1http, tls
EventResultDetails_s3eq 2, in 1NXDOMAIN, REFUSED, SERVFAIL
EventTime_t3gt 3min_t
Name3contains 3.
TimeGenerated3gt 2, ge 1, le 1maxSummarizedTime, FullWindowEnd, FullWindowStart
data_stream.dataset3in 3network_traffic.http, network_traffic.tls
event.category3in 3network, network_traffic
score3ge 35
DGADomain2gt 2, regex_match 28, ^[A-Za-z]{0,}$
DnsQueryTypeName2in 2A, AAAA
IsActive2eq 2true
ObservableKey2eq 2domain-name:value, ipv4-addr:value
ObservableValue2is_not_null 2

Top indicator values (409 distinct)

Specific (field, operator, value) combinations the rules check for, ranked by how many rules under this technique use each one. The Corpus reach column counts how many rules across the entire catalog (any technique) check the same combination. High numbers point to widely-used indicators that are likely noisy on their own; combine them with another condition for useful signal. Blank means the combination is specific to rules under this technique. Click a value to expand the rules under this technique that use it.

FieldKindValueRules (here)Corpus reach
EventTime_tgt
min_t
34
Namecontains
.
37
data_stream.datasetin
network_traffic.http
34
data_stream.datasetin
network_traffic.tls
34
event.categoryin
network
315
event.categoryin
network_traffic
315
scorege
5
36
DGADomaingt
8
22
DGADomainregex_match
^[A-Za-z]{0,}$
22
DestinationHostnamecontains
tunnel.ap.ngrok.com
22
DestinationHostnamecontains
tunnel.au.ngrok.com
22
DestinationHostnamecontains
tunnel.eu.ngrok.com
22
DestinationHostnamecontains
tunnel.in.ngrok.com
22
DestinationHostnamecontains
tunnel.jp.ngrok.com
22
DestinationHostnamecontains
tunnel.sa.ngrok.com
22
DestinationHostnamecontains
tunnel.us.ngrok.com
22
DestinationPortNamein
http
22
DestinationPortNamein
tls
22
DnsQueryTypeNamein
A
22
DnsQueryTypeNamein
AAAA
22
EventResultDetails_seq
NXDOMAIN
22
IsActiveeq
true
217
Protocoleq
tcp
218
QueryNamecontains
.
22
TimeGeneratedgt
maxSummarizedTime
24
count_gt
1
28
count_gt
200
25
dcount_sldgt
100
22
descriptionstarts_with
Recorded Future - Threat Hunt
24
dns.question.namewildcard
*.blob.core.windows.net
22

Exclusions (104 distinct)

Field/operator/value combinations excluded by rules under this technique (top-level not() clauses), sorted by how many rules exclude each. These are the false-positive paths the community has learned to filter out. A new rule that ignores the high-count entries here will likely fire on the same noisy paths. Click a value to expand the rules under this technique that exclude it.

FieldKindValueRules excluding
Namecontains
.
3
DGADomaingt
8
2
DGADomainregex_match
^[A-Za-z]{0,}$
2
Nameends_with
.home
2
Nameends_with
.lan
2
QueryNamecontains
/
2
SourceIpcidr_match
127.0.0.1
2
count_gt
1
2
dcount_sldgt
100
2
triCountgt
500
2
ClientIPcidr_match
127.0.0.1
1
DNSQueryCountgt
100
1
DestinationHostnameeq
zoom.us
1
Imagewildcard
/opt/elastic/agent/data/elastic-agent-*/components/elastic-otel-collector
1
Imagewildcard
/opt/google-cloud-ops-agent/subagents/fluent-bit/bin/fluent-bit
1

Rules under this technique

Every rule in the catalog tagged with this technique, grouped by vendor. Click a rule title for its full predicates, exclusions, and indicators.

Platform (all)
Domain (all)

Sigma 6 rules

Elastic 10 rules

Kusto 17 rules

YARA-L 1 rule