ATT&CK coverage › Technique

Dynamic Resolution `T1568`

Adversaries may dynamically establish connections to command and control infrastructure to evade common detections and remediations. This may be achieved by using malware that shares a common algorithm with the infrastructure the adversary uses to receive the malware's communications. These calculations can be used to dynamically adjust parameters such as the domain name, IP address, or port number the malware uses for command and control.

Events covered

9 catalog events are tagged with this technique by at least one rule.

Provider	Event ID	Title
Sysmon	3	Network connection
Sysmon	22	DNSEvent (DNS query)
Security-Auditing	5152	The Windows Filtering Platform blocked a packet.
Security-Auditing	5154	The Windows Filtering Platform has permitted an application or service to listen on a port for incoming connections.
Security-Auditing	5155	The Windows Filtering Platform has blocked an application or service from listening on a port for incoming connections.
Security-Auditing	5156	The Windows Filtering Platform has permitted a connection.
Security-Auditing	5157	The Windows Filtering Platform has blocked a connection.
Security-Auditing	5158	The Windows Filtering Platform has permitted a bind to a local port.
Security-Auditing	5159	The Windows Filtering Platform has blocked a bind to a local port.

Authoring guide

Patterns shared across the 5 rules above: which fields they filter on, what specific values they look for, and what they exclude. Field names are normalized across vendors so Sigma's Image, Elastic's process.name, and Splunk's process_name collapse into one row. Each rule contributes at most once per row.

Fields filtered most (6 distinct)

The fields most rules look at when detecting this technique. The How column shows the operators authors use (eq, wildcard, regex_match, match) and how often each appears. Sample values are concrete examples to start from, not an exhaustive list.

Field	Rules	How	Sample values
`EventResultDetails`	1	`match` 1	`errors`
`NXDOMAINCount`	1	`gt` 1	`threshold`
`count_`	1	`gt` 1	`threshold`
`DnsResponseCodeName`	1	`is_not_null` 1
`Domain`	1	`is_not_null` 1
`dest_ip`	1	`is_not_null` 1

Top indicator values (3 distinct)

Specific (field, operator, value) combinations the rules check for, ranked by how many rules under this technique use each one. The Corpus reach column counts how many rules across the entire catalog (any technique) check the same combination. High numbers point to widely-used indicators that are likely noisy on their own; combine them with another condition for useful signal. Blank means the combination is specific to rules under this technique.

Field	Kind	Value	Rules (here)
`EventResultDetails`	`match`	`errors`	1
`NXDOMAINCount`	`gt`	`threshold`	1
`count_`	`gt`	`threshold`	1

Rules under this technique

Every rule in the catalog tagged with this technique, grouped by vendor. Click a rule title for its full predicates, exclusions, and indicators.

Kusto Query Language 5 rules

Detect DNS queries reporting multiple errors from different clients - Static threshold based (ASIM DNS Solution) 1 event, 1 indicator, 0 exclusions
Detect excessive NXDOMAIN DNS queries - Static threshold based (ASIM DNS Solution) 1 event, 1 indicator, 0 exclusions
Excessive NXDOMAIN DNS Queries (ASIM DNS Schema) 1 event, 1 indicator, 0 exclusions
RecordedFuture Threat Hunting Domain All Actors 1 event, 0 indicators, 0 exclusions
RecordedFuture Threat Hunting IP All Actors 8 events, 0 indicators, 0 exclusions