ATT&CK · T1568.003 · sub-technique
DNS Calculation
Tactics: command-and-control
About
Adversaries may perform calculations on addresses returned in DNS results to determine which port and IP address to use for command and control, rather than relying on a predetermined port number or the actual returned IP address. A IP and/or port number calculation can be used to bypass egress filtering on a C2 channel. One implementation of DNS Calculation is to take the first three octets of an IP address in a DNS response and use those values to calculate the port for command and control traffic.
Used by actors
1 known groups
Software
0 malware/tools implement this
None mapped.
Corpus indicators tagged with this technique
0 indicators in the corpus carry T1568.003.
No corpus indicators are tagged with this technique yet.