cyberstrikeus T1568.003 DNS Calculation
Sub-technique of: T1568
High-Level Description
Adversaries may perform calculations on addresses returned in DNS results to determine which port and IP address to use for command and control, rather than relying on a predetermined port number or the actual returned IP address. A IP and/or port number calculation can be used to bypass egress filtering on a C2 channel.
One implementation of DNS Calculation is to take the first three octets of an IP address in a DNS response and use those values to calculate the port for command and control traffic.
Kill Chain Phase
- Command and Control (TA0011)
Platforms: Linux, macOS, Windows, ESXi
What to Check
- Identify if DNS Calculation technique is applicable to target environment
- Check Linux systems for indicators of DNS Calculation
- Check macOS systems for indicators of DNS Calculation
- Check Windows systems for indicators of DNS Calculation
- Assess detection coverage (1 detection strategies)
How to Test
Manual Testing
Identify Attack Surface: Determine if the target environment is susceptible to DNS Calculation by examining the target platforms (Linux, macOS, Windows).
Assess Existing Defenses: Review whether mitigations for T1568.003 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.
Note: No Atomic Red Team tests available for this technique. See Atomic Red Team GitHub for updates.
Remediation Guide
No specific mitigations documented for this technique.
Detection
Detection Strategy for Dynamic Resolution through DNS Calculation
Risk Assessment
| Finding | Severity | Impact |
|---|---|---|
| DNS Calculation technique applicable | Low | Command And Control |
CWE Categories
| CWE ID | Title |
|---|---|
| CWE-300 | Channel Accessible by Non-Endpoint |