Куда я попал?

SECURITM это SGRC система, автоматизирующая процессы в службах информационной безопасности. SECURITM помогает построить и управлять ИСПДн, КИИ, ГИС, СМИБ/СУИБ, банковскими системами защиты.
А еще SECURITM это место для обмена опытом и наработками для служб безопасности.

Подробнее

Dynamic Resolution

Sub-techniques (3)

ID	Name
.001	Fast Flux DNS
.002	Domain Generation Algorithms
.003	DNS Calculation

Adversaries may dynamically establish connections to command and control infrastructure to evade common detections and remediations. This may be achieved by using malware that shares a common algorithm with the infrastructure the adversary uses to receive the malware's communications. These calculations can be used to dynamically adjust parameters such as the domain name, IP address, or port number the malware uses for command and control. Adversaries may use dynamic resolution for the purpose of Fallback Channels. When contact is lost with the primary command and control server malware may employ dynamic resolution as a means to reestablishing command and control.(Citation: Talos CCleanup 2017)(Citation: FireEye POSHSPY April 2017)(Citation: ESET Sednit 2017 Activity)

ID: T1568

Sub-techniques: .001 .002 .003

Tactic(s): Command and Control

Platforms: ESXi, Linux, Windows, macOS

Data Sources: Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow

Version: 1.1

Created: 10 Mar 2020

Last Modified: 25 Apr 2025

Name	Description
Procedure Examples
Tomiris	Tomiris has connected to a signalization server that provides a URL and port, and then Tomiris sends a GET request to that URL to establish C2.(Citation: Kaspersky Tomiris Sep 2021)
NETEAGLE	NETEAGLE can use HTTP to download resources that contain an IP address and port number pair to connect to for C2.(Citation: FireEye APT30)
Bisonal	Bisonal has used a dynamic DNS service for C2.(Citation: Talos Bisonal Mar 2020)
AsyncRAT	AsyncRAT can be configured to use dynamic DNS.(Citation: AsyncRAT GitHub)
RTM	RTM has resolved Pony C2 server IP addresses by either converting Bitcoin blockchain transaction data to specific octets, or accessing IP addresses directly within the Namecoin blockchain.(Citation: CheckPoint Redaman October 2019)(Citation: Unit42 Redaman January 2019)
SUNBURST	SUNBURST dynamically resolved C2 infrastructure for randomly-generated subdomains within a parent domain.(Citation: FireEye SUNBURST Backdoor December 2020)
Maze	Maze has forged POST strings with a random choice from a list of possibilities including "forum", "php", "view", etc. while making connection with the C2, hindering detection efforts.(Citation: McAfee Maze March 2020)
Gelsemium	Gelsemium can use dynamic DNS domain names in C2.(Citation: ESET Gelsemium June 2021)
Gamaredon Group	Gamaredon Group has incorporated dynamic DNS domains in its infrastructure.(Citation: Unit 42 Gamaredon February 2022)
APT29	APT29 used dynamic DNS resolution to construct and resolve to randomly-generated subdomains for C2.(Citation: Volexity SolarWinds)
APT29	APT29 has used Dynamic DNS providers for their malware C2 infrastructure.(Citation: Mandiant APT29 Eye Spy Email Nov 22)
TA2541	TA2541 has used dynamic DNS services for C2 infrastructure.(Citation: Proofpoint TA2541 February 2022)
Transparent Tribe	Transparent Tribe has used dynamic DNS services to set up C2.(Citation: Proofpoint Operation Transparent Tribe March 2016)
RedEcho	RedEcho used dynamic DNS domains associated with malicious infrastructure.(Citation: RecordedFuture RedEcho 2021)
BITTER	BITTER has used DDNS for C2 communications.(Citation: Forcepoint BITTER Pakistan Oct 2016)
UNC2452	UNC2452 used dynamic DNS resolution to construct and resolve to randomly-generated subdomains for C2.(Citation: Volexity SolarWinds)

Mitigation	Description
Mitigations
Network Intrusion Prevention	Use intrusion detection signatures to block traffic at network boundaries.
Restrict Web-Based Content	Restricting web-based content involves enforcing policies and technologies that limit access to potentially malicious websites, unsafe downloads, and unauthorized browser behaviors. This can include URL filtering, download restrictions, script blocking, and extension control to protect against exploitation, phishing, and malware delivery. This mitigation can be implemented through the following measures: Deploy Web Proxy Filtering: - Use solutions to filter web traffic based on categories, reputation, and content types. - Enforce policies that block unsafe websites or file types at the gateway level. Enable DNS-Based Filtering: - Implement tools to restrict access to domains associated with malware or phishing campaigns. - Use public DNS filtering services to enhance protection. Enforce Content Security Policies (CSP): - Configure CSP headers on internal and external web applications to restrict script execution, iframe embedding, and cross-origin requests. Control Browser Features: - Disable unapproved browser features like automatic downloads, developer tools, or unsafe scripting. - Enforce policies through tools like Group Policy Management to control browser settings. Monitor and Alert on Web-Based Threats: - Use SIEM tools to collect and analyze web proxy logs for signs of anomalous or malicious activity. - Configure alerts for access attempts to blocked domains or repeated file download failures.

Detection

Detecting dynamically generated C2 can be challenging due to the number of different algorithms, constantly evolving malware families, and the increasing complexity of the algorithms. There are multiple approaches to detecting a pseudo-randomly generated domain name, including using frequency analysis, Markov chains, entropy, proportion of dictionary words, ratio of vowels to other characters, and more (Citation: Data Driven Security DGA). CDN domains may trigger these detections due to the format of their domain names. In addition to detecting algorithm generated domains based on the name, another more general approach for detecting a suspicious domain is to check for recently registered names or for rarely visited domains.

References

Связанные риски

Ничего не найдено

Каталоги

Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.