Dynamic Resolution: Fast Flux DNS `T1568.001`

Tactic: Command & Control

Adversaries may use Fast Flux DNS to hide a command and control channel behind an array of rapidly changing IP addresses linked to a single domain resolution. This technique uses a fully qualified domain name, with multiple IP addresses assigned to it which are swapped with high frequency, using a combination of round robin IP addressing and short Time-To-Live (TTL) for a DNS resource record.

Authoring guide

These 1 rule share fields, values, and exclusions.

Fields filtered most (7 distinct)

These fields appear most often in rule filters.

Field	Rules	How	Sample values
`Action`	1	`eq` 1	`Deny`
`AlertTimeSrcIpDenyRateCount`	1	`cross_field_compare` 1	`LearningThreshold`
`Fqdn`	1	`is_not_null` 1
`LearningTimeBuckets`	1	`gt` 1	`5`
`OperationName`	1	`eq` 1	`AzureFirewallApplicationRuleLog`, `AzureFirewallNetworkRuleLog`
`TimeGenerated`	1	`ge` 1, `le` 1	`FullWindowEnd`, `FullWindowStart`
`src_ip`	1	`is_not_null` 1

Top indicator values (7 distinct)

These values appear most often in rule predicates.

Field	Kind	Value	Rules (here)	Corpus reach
`Action`	`eq`	`Deny` kustoAbnormal Deny Rate for Source IP	1	2
`AlertTimeSrcIpDenyRateCount`	`cross_field_compare`	`LearningThreshold` kustoAbnormal Deny Rate for Source IP	1	2
`LearningTimeBuckets`	`gt`	`5` kustoAbnormal Deny Rate for Source IP	1	2
`OperationName`	`eq`	`AzureFirewallApplicationRuleLog` kustoAbnormal Deny Rate for Source IP	1	4
`OperationName`	`eq`	`AzureFirewallNetworkRuleLog` kustoAbnormal Deny Rate for Source IP	1	3
`TimeGenerated`	`ge`	`FullWindowStart` kustoAbnormal Deny Rate for Source IP	1
`TimeGenerated`	`le`	`FullWindowEnd` kustoAbnormal Deny Rate for Source IP	1

Rules under this technique

These vendors publish rules tagged with this technique.

Platform: Azure

Domain: Cloud

Kusto 1 rule