T1568.003 — DNS Calculation

Tactic: Command and Control · Platforms: ESXi, Linux, macOS, Windows

Adversaries may perform calculations on addresses returned in DNS results to determine which port and IP address to use for command and control, rather than relying on a predetermined port number or the actual returned IP address. A IP and/or port number calculation can be used to bypass egress…

Sub-technique of Dynamic Resolution (T1568).

Sigma detection rules (4)

T1568.003 Dynamic Resolution: DNS Calculation

title: "T1568.003 Dynamic Resolution: DNS Calculation"
id: 62f4a1c2-29ab-4c3a-92c7-748084ff253f
description: 'Detection Strategy for Dynamic Resolution through DNS Calculation. The technique''s defining behavior -- deriving a C2 port/IP from arithmetic on a DNS answer -- is not a discrete field Windows telemetry exposes in a single event; this rule is a best-effort proxy restricted to living-off-the-land interpreters/binaries connecting on non-standard (non-web) ports, and should be paired with a correlation rule joining the preceding DNSQuery (EventID 22) for real confirmation. (Data Component: Network Connection Creation; baseline tier: windows-eventid.) Tune using: PortDeviationThreshold, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1568/003
author: Shahrukh Khan
date: 2026-01-20
license: MIT
tags:
  - attack.command-and-control
  - attack.t1568.003

logsource:
  category: network_connection
  product: windows
  service: sysmon

detection:
  selection_process:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\rundll32.exe'
      - '\mshta.exe'
      - '\regsvr32.exe'
      - '\certutil.exe'
      - '\cscript.exe'
      - '\wscript.exe'

  selection_conn:
    Initiated: 'true'
    DestinationPort|gte: 1024

  filter_common_ports:
    DestinationPort:
      - 80
      - 443
      - 8080
      - 8443
      - 3128

  condition: selection_process and selection_conn and not filter_common_ports

falsepositives:
  - Ephemeral high-numbered ports and LOLBin network activity are common in legitimate automation; true port-rotation/DNS-derived C2 can only be confirmed by correlating this connection with the preceding DNS answer (IP-octet/port formula), which a single network_connection event cannot express on its own -- pair with a correlation rule against EventID 22 (DNSQuery) grouped by process and time window.

level: informational

T1568.003 Dynamic Resolution: DNS Calculation

title: "T1568.003 Dynamic Resolution: DNS Calculation"
id: c1a09a5d-fa98-4f6a-ada9-20e64af64b43
description: 'Detection Strategy for Dynamic Resolution through DNS Calculation. The technique''s defining behavior -- computing a C2 port/IP from octets in a DNS response -- is not observable via host auditd telemetry: auditd SYSCALL records for connect() do not expose a decoded destination port/IP (the sockaddr argument is an opaque pointer), and there is no DNS-response-content visibility at the syscall layer. This cannot be meaningfully detected with auditd/syslog alone and would require network-flow/DNS-response correlation instead. As a closest defensible Linux-observable proxy, this rule flags successful outbound connect() syscalls made by processes executing from non-standard, world-writable locations, which is a generic anomalous-network-activity signal, not evidence of DNS-calculated C2 specifically. Tune using: EphemeralPortRange, ResolverWhitelist.'
references:
  - https://attack.mitre.org/techniques/T1568/003
author: Shahrukh Khan
date: 2026-01-09
license: MIT
tags:
  - attack.command-and-control
  - attack.t1568.003

logsource:
  category: network_connection
  product: linux

detection:
  selection_connect:
    type: SYSCALL
    syscall: connect
    success: yes
  selection_anomalous_path:
    exe|contains:
      - '/tmp/'
      - '/var/tmp/'
      - '/dev/shm/'
      - '/home/'
  filter_resolvers:
    exe:
      - '/usr/sbin/systemd-resolved'
      - '/usr/bin/dig'
      - '/usr/bin/host'
  condition: selection_connect and selection_anomalous_path and not filter_resolvers

falsepositives:
  - This is a generic "process running from a writable/home path made a successful outbound connection" proxy, not specific to DNS-calculated C2; user-installed applications, dev/test binaries, and scripts legitimately run from /tmp or home directories will also match.

level: low

T1568.003 Dynamic Resolution: DNS Calculation

title: "T1568.003 Dynamic Resolution: DNS Calculation"
id: dee0d19e-7c0b-47b2-8535-b2a39acd3312
description: 'Detection Strategy for Dynamic Resolution through DNS Calculation. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: ProcessAllowlist, ConnectionVolumeThreshold.'
references:
  - https://attack.mitre.org/techniques/T1568/003
author: Shahrukh Khan
date: 2026-02-14
license: MIT
tags:
  - attack.command-and-control
  - attack.t1568.003

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith:
      - '/curl'
      - '/python3'
    CommandLine|contains: 'dnspython'

  condition: selection

falsepositives:
  - DNS-calculation based C2 domain generation executes entirely inside process memory using values the process itself computes, leaving no distinguishing command line or file artifact, so this rule can only catch an unusually named helper library import and will miss the actual technique in most real cases.

level: low

T1568.003 Dynamic Resolution: DNS Calculation

title: "T1568.003 Dynamic Resolution: DNS Calculation"
id: 1e676855-0e7f-4c56-88d9-1bb0958e2a10
description: 'Detection Strategy for Dynamic Resolution through DNS Calculation. (Retargeted to the process_creation ESXi telemetry that actually captures this techniques behavior; see logsource below.) Tune using: ManagementPlaneIPs, DomainReputationFeed.'
references:
  - https://attack.mitre.org/techniques/T1568/003
author: Shahrukh Khan
date: 2026-06-27
license: MIT
tags:
  - attack.command-and-control
  - attack.t1568.003

logsource:
  product: esxi
  service: shell

detection:
  selection:
    CommandLine|contains:
      - 'esxcli network ip dns server add'
      - '/etc/resolv.conf'

  condition: selection

falsepositives:
  - DNS-calculation resolution logic is entirely invisible to ESXi host logging; this rule can only flag resolver configuration edits from ManagementPlaneIPs outside expectation and cannot itself assess DomainReputationFeed matches.

level: low

Related sub-techniques

Explore