T1568.003 DNS Calculation
sub-techniqueEnterpriseAdversaries may perform calculations on addresses returned in DNS results to determine which port and IP address to use for command and control, rather than relying on a predetermined port number or the actual returned IP address. A IP and/or port number calculation can be used to bypass egress filtering on a C2 channel. One implementation of DNS Calculation is to take the first three octets of an IP address in a DNS response and use those values to calculate the port for command and control traffic.
01
platforms
Platforms this applies to.
ESXiLinuxmacOSWindows
02
tactics
ATT&CK tactics this technique serves.
03
sub-technique of
The broader entity this sits under.
04
detected by (4)
Data components that detect this.
05
groups (1)
Threat groups associated with this.
06
source
Where this definition is published.