Dynamic Resolution

Adversaries may dynamically establish connections to command and control infrastructure to evade common detections and remediations. This may be achieved by using malware that shares a common algorithm with the infrastructure the adversary uses to receive the malware's communications. These calculations can be used to dynamically adjust parameters such as the domain name, IP address, or port number the malware uses for command and control.

Adversaries may use dynamic resolution for the purpose of Fallback Channels. When contact is lost with the primary command and control server malware may employ dynamic resolution as a means to reestablishing command and control.[1][2][3]

ID: T1568
Sub-techniques:  T1568.001, T1568.002, T1568.003
Platforms: Linux, Windows, macOS
Permissions Required: User
Contributors: Chris Roffe
Version: 1.0
Created: 10 March 2020
Last Modified: 02 October 2020
Provided by LAYER 8

Procedure Examples

ID Name Description
G0016 APT29

APT29 used dynamic DNS resolution to construct and resolve to randomly-generated subdomains for C2.[4]

S0449 Maze

Maze has forged POST strings with a random choice from a list of possibilities including "forum", "php", "view", etc. while making connection with the C2, hindering detection efforts.[5]


NETEAGLE can use HTTP to download resources that contain an IP address and port number pair to connect to for C2.[6]

S0148 RTM

RTM has resolved Pony C2 server IP addresses by either converting Bitcoin blockchain transaction data to specific octets, or accessing IP addresses directly within the Namecoin blockchain.[7][8]


SUNBURST dynamically resolved C2 infrastructure for randomly-generated subdomains within a parent domain.[9]

G0134 Transparent Tribe

Transparent Tribe has used dynamic DNS services to set up C2.[10]


ID Mitigation Description
M1031 Network Intrusion Prevention

Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level. Malware researchers can reverse engineer malware variants that use dynamic resolution and determine future C2 infrastructure that the malware will attempt to contact, but this is a time and resource intensive effort.[11][12]

M1021 Restrict Web-Based Content

In some cases a local DNS sinkhole may be used to help prevent behaviors associated with dynamic resolution.


ID Data Source Data Component
DS0029 Network Traffic Network Connection Creation
Network Traffic Content
Network Traffic Flow

Detecting dynamically generated C2 can be challenging due to the number of different algorithms, constantly evolving malware families, and the increasing complexity of the algorithms. There are multiple approaches to detecting a pseudo-randomly generated domain name, including using frequency analysis, Markov chains, entropy, proportion of dictionary words, ratio of vowels to other characters, and more [13]. CDN domains may trigger these detections due to the format of their domain names. In addition to detecting algorithm generated domains based on the name, another more general approach for detecting a suspicious domain is to check for recently registered names or for rarely visited domains.