Techniques › T1568 › T1568.003
T1568.003 DNS Calculation
command and control — ESXi, Linux, macOS, Windows · attack.mitre.org · JSON
1
MITRE detection strategy
4
analytics
0
Sigma rules tagged attack.t1568.003
0
KEV CVEs mapped here
<p>Adversaries may perform calculations on addresses returned in DNS results to determine which port and IP address to use for command and control, rather than relying on a predetermined port number or the actual returned IP address. A IP and/or port number calculation can be used to bypass egress filtering on a C2 channel.</p><p>One implementation of DNS Calculation is to take the first three octets of an IP address in a DNS response and use those values to calculate the port for command and control traffic.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0262 Detection Strategy for Dynamic Resolution through DNS Calculation v1.0
AN0728 WindowsMonitor DNS query results where subsequent connections use derived or unusual port numbers not explicitly resolved, especially when tied to suspicious processes. Correlate Sysmon DNS logs (Event ID 22) with process creation and socket activity.Tunable:
PortDeviationThresholdTimeWindowAN0729 LinuxInspect resolver and audit logs for processes initiating outbound connections to ports calculated from DNS response IPs. Abnormal ephemeral port usage shortly after DNS queries can indicate DNS calculation behavior.linux:syslogDNS response IPs followed by connections to non-standard calculated ports→ DC0085 Network Traffic ContentTunable:EphemeralPortRangeResolverWhitelistAN0730 macOSUse unified logs to detect unusual DNS responses correlated with subsequent connections to calculated or non-standard ports. Monitor non-browser apps making repeated outbound connections that deviate from expected patterns.macos:unifiedlogDNS responses followed by connections to ports outside standard ranges→ DC0085 Network Traffic Contentmacos:unifiedlogUnexpected processes making network calls based on DNS-derived ports→ DC0032 Process CreationTunable:ProcessAllowlistConnectionVolumeThresholdAN0731 ESXiAnalyze ESXi syslogs for management agents or VMs making outbound connections to dynamically calculated ports derived from DNS responses. Cross-check with VM traffic baselines to identify anomalies.esxi:syslogDNS resolution events leading to outbound traffic on unexpected ports→ DC0078 Network Traffic FlowTunable:ManagementPlaneIPsDomainReputationFeed
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1568.003
No Sigma rule carries this tag. MITRE publishes a detection strategy above, so the behaviour is specified; what is missing is public detection content.
Rules tagged at the parent level (attack.t1568) 2
These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.
Author: Florian Roth (Nextron Systems)
· 2017-11-08 (modified 2023-05-18) · logsource: category=proxy · 195c1119-ef07-4909-bb12-e66f5e07bf3c
Detects download of certain file types from hosts with dynamic DNS names (selected list)
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2026-04-01 · logsource: category=dns · 73e5d24f-493f-4092-bd2f-c72cabda40ee
Detects DNS queries for the malicious C2 domain associated with the plain-crypto-js/Axios npm package supply chain compromise.
On March 30, 2026, malicious versions (1.14.1, 0.30.4) were published to npm, injecting a dependency (plain-crypto-js@4.2.1) that executed a postinstall script as a cross-platform RAT dropper.
This detection detects endpoints attempting to resolve the attacker's C2 domain (sfrclak.com) used for command and control communication.