T1568 — Dynamic Resolution

# T1568 - Dynamic Resolution

## SOC Recommendation
Investigate Dynamic Resolution activity in the context of Command and Control: confirm scope, affected host/identity, and whether it matches expected administrative behaviour before deciding this is benign.

## D3FEND Mappings
| D3FEND Technique | Relationship | Practical SOC Action |
|---|---|---|
| Relay Pattern Analysis | Detect | Monitor for Relay Pattern Analysis indicators relevant to this technique. |
| DNS Denylisting | Isolate | Apply DNS Denylisting to contain the blast radius once this technique is observed. |

## Investigation Steps
1. Review Defender for Endpoint / Defender XDR alerts and timeline for the affected host or identity.
2. Check Sentinel analytics rules and incidents correlated with this technique.
3. Review Entra ID sign-in and audit logs if the technique involves an identity or cloud resource.

## Evidence to Collect
- Host or resource affected
- Account or identity involved
- Timestamp of the activity
- Related process, file, or network artifact
- Any preceding or follow-on alerts

## Response Actions
| Action | Risk | Automation Safe | Approval Required |
|---|---|---|---|
| Block the parent domain at firewall and DNS sinkhole | Medium | No | Yes |
| Isolate device if process confirmed malicious | Medium | No | Yes |
| Submit IOCs to Sentinel TI watchlist | Low | Yes | No |

## KQL
```kql
let TrustedDomains = dynamic([
    "microsoft.com", "windows.com", "office.com", "azure.com", "google.com",
    "amazonaws.com", "akamai.com", "cloudflare.com", "digicert.com"
]);
let Tunnelling = (
    DeviceNetworkEvents
    | where TimeGenerated >= ago(1h)
    | where ActionType == "DnsQueryResponse"
    | where not(RemoteUrl has_any (TrustedDomains))
    | extend DomainLen = strlen(RemoteUrl)
    | where DomainLen > 50 or RemoteUrl matches regex @"[a-z0-9]{20,}\."
    | summarize QueryCount = count(), UniqueDomains = dcount(RemoteUrl), SampleDomains = make_set(RemoteUrl, 5)
        by DeviceName, InitiatingProcessFileName
    | where QueryCount > 30
    | extend DetectionType = "DNS_Tunnelling"
);
let DGA = (
    DeviceNetworkEvents
    | where TimeGenerated >= ago(1h)
    | where ActionType == "ConnectionFailed"
    | where not(RemoteUrl has_any (TrustedDomains))
    | summarize FailCount = count(), UniqueDomains = dcount(RemoteUrl), SampleDomains = make_set(RemoteUrl, 5)
        by DeviceName, InitiatingProcessFileName
    | where FailCount > 100 and UniqueDomains > 50
    | extend DetectionType = "DGA_Pattern"
);
Tunnelling
| union DGA
| extend timestamp = now(), HostCustomEntity = DeviceName
| order by QueryCount desc
```
```kql
// Network Indicators query with Block Recommended Action and C2 Roles
let timeFrame= 5m;
CyfirmaIndicators_CL 
| where ConfidenceScore >= 80
    and TimeGenerated between (ago(timeFrame) .. now())
    and pattern !contains 'file:hashes' and RecommendedActions has 'Block' and (Roles contains 'c2' or Roles contains 'Command & Control')
| extend IPv4 = extract(@"ipv4-addr:value\s*=\s*'([^']+)'", 1, pattern)
| extend IPv6 = extract(@"ipv6-addr:value\s*=\s*'([^']+)'", 1, pattern)
| extend URL = extract(@"url:value\s*=\s*'([^']+)'", 1, pattern)
| extend Domain = extract(@"domain-name:value\s*=\s*'([^']+)'", 1, pattern)
| extend parsed = parse_json(extensions)
| extend extensionKeys = bag_keys(parsed)
| mv-expand extensionKeys
| extend extensionKeyStr = tostring(extensionKeys)
| extend ext = parsed[extensionKeyStr]
| extend props = ext.properties
| extend 
    extension_id = extensionKeyStr,
    ASN_Owner = props.asn_owner,
    ASN = props.asn,
    ProviderName = 'CYFIRMA',
    ProductName = 'DeCYFIR/DeTCT'
| project
    IPv4,
    IPv6,
    URL,
    Domain,
    ThreatActors,
    RecommendedActions,
    Sources,
    Roles,
    Country,
    IPAbuse,
    name,
    Description,
    ConfidenceScore,
    IndicatorID,
    created,
    modified,
    valid_from,
    Tags,
    ThreatType,
    TimeGenerated,
    SecurityVendors,
    ProductName,
    ProviderName
```
```kql
// Network Indicators query with Monitor Recommended Action And C2 Roles
let timeFrame= 5m;
CyfirmaIndicators_CL 
| where ConfidenceScore >= 80
    and TimeGenerated between (ago(timeFrame) .. now())
    and pattern !contains 'file:hashes' and RecommendedActions has 'Monitor' and (Roles contains 'c2' or Roles contains 'Command & Control')
| extend IPv4 = extract(@"ipv4-addr:value\s*=\s*'([^']+)'", 1, pattern)
| extend IPv6 = extract(@"ipv6-addr:value\s*=\s*'([^']+)'", 1, pattern)
| extend URL = extract(@"url:value\s*=\s*'([^']+)'", 1, pattern)
| extend Domain = extract(@"domain-name:value\s*=\s*'([^']+)'", 1, pattern)
| extend parsed = parse_json(extensions)
| extend extensionKeys = bag_keys(parsed)
| mv-expand extensionKeys
| extend extensionKeyStr = tostring(extensionKeys)
| extend ext = parsed[extensionKeyStr]
| extend props = ext.properties
| extend 
    extension_id = extensionKeyStr,
    ASN_Owner = props.asn_owner,
    ASN = props.asn,
    ProviderName = 'CYFIRMA',
    ProductName = 'DeCYFIR/DeTCT'
| project
    IPv4,
    IPv6,
    URL,
    Domain,
    ThreatActors,
    RecommendedActions,
    Sources,
    Roles,
    Country,
    IPAbuse,
    name,
    Description,
    ConfidenceScore,
    IndicatorID,
    created,
    modified,
    valid_from,
    Tags,
    ThreatType,
    TimeGenerated,
    SecurityVendors,
    ProductName,
    ProviderName
```

## Escalation Criteria
- Dynamic Resolution activity observed on a privileged account or critical system.
- Activity follows or precedes other suspicious behaviour in the same investigation.
- Automated triage cannot confidently rule out malicious intent.

## False Positive Considerations
- Legitimate administrative or maintenance activity matching this pattern.
- Approved security testing or red team exercise.
- Known benign software producing similar telemetry.

Generated by SOC Response Atlas by Basyrix.

Want to push this directly to Confluence? Upgrade to Basyrix Pro.

• /api/techniques/T1568.json
• /api/recommendations/T1568.json
• /api/d3fend/T1568.json
• /api/mappings/T1568.json
• /api/confluence/T1568.md

Example curl:

curl https://atlas.basyrix.com/api/recommendations/T1568.json

Response:

{
  "technique_id": "T1568",
  "name": "Dynamic Resolution",
  "priority": "high",
  "status": "complete",
  "version": "0.1.0",
  "last_reviewed": "2026-07-23",
  "generated_by": "SOC Response Atlas by Basyrix",
  "tactics": [
    "Command and Control"
  ],
  "platforms": [
    "ESXi",
    "Linux",
    "macOS",
    "Windows"
  ],
  "summary": "Adversaries may dynamically establish connections to command and control infrastructure to evade common detections and remediations. This may be achieved by using malware that shares a common algorithm with the infrastructure the adversary uses to receive the malware's communications. These calculations can be used to dynamically adjust parameters such as the domain name, IP address, or port number the malware uses for command and control...",
  "soc_recommendation": "Investigate Dynamic Resolution activity in the context of Command and Control: confirm scope, affected host/identity, and whether it matches expected administrative behaviour before deciding this is benign.",
  "d3fend_mappings": [
    {
      "id": "D3-RPA",
      "name": "Relay Pattern Analysis",
      "relationship": "detect",
      "practical_action": "Monitor for Relay Pattern Analysis indicators relevant to this technique.",
      "tooling": [
        "Defender for Endpoint"
      ]
    },
    {
      "id": "D3-DNSDL",
      "name": "DNS Denylisting",
      "relationship": "isolate",
      "practical_action": "Apply DNS Denylisting to contain the blast radius once this technique is observed.",
      "tooling": [
        "Defender for Endpoint"
      ]
    }
  ],
  "investigation_steps": {
    "microsoft": [
      "Review Defender for Endpoint / Defender XDR alerts and timeline for the affected host or identity.",
      "Check Sentinel analytics rules and incidents correlated with this technique.",
      "Review Entra ID sign-in and audit logs if the technique involves an identity or cloud resource."
    ],
    "generic": [
      "Confirm whether the observed dynamic resolution activity matches expected administrative or application behaviour.",
      "Identify the host, account, or resource where the activity occurred and its business criticality.",
      "Check for related alerts before and after this activity to reconstruct the broader intrusion timeline.",
      "Real detection reference: \"DNS Tunnelling and DGA\" -- Flags DNS tunnelling (abnormally long high-entropy subdomains) and DGA malware (high-volume failed resolutions for random-looking domains)."
    ]
  },
  "evidence_to_collect": [
    "Host or resource affected",
    "Account or identity involved",
    "Timestamp of the activity",
    "Related process, file, or network artifact",
    "Any preceding or follow-on alerts"
  ],
  "response_actions": [
    {
      "name": "Block the parent domain at firewall and DNS sinkhole",
      "category": "Response",
      "risk": "Medium",
      "automation_safe": false,
      "approval_required": true,
      "tool": "See investigation guide"
    },
    {
      "name": "Isolate device if process confirmed malicious",
      "category": "Response",
      "risk": "Medium",
      "automation_safe": false,
      "approval_required": true,
      "tool": "See investigation guide"
    },
    {
      "name": "Submit IOCs to Sentinel TI watchlist",
      "category": "Response",
      "risk": "Low",
      "automation_safe": true,
      "approval_required": false,
      "tool": "Sentinel"
    }
  ],
  "queries": {
    "kql": [
      {
        "name": "GEN-CC-002 — DNS Tunnelling and DGA",
        "description": "Flags DNS tunnelling (abnormally long high-entropy subdomains) and DGA malware (high-volume failed resolutions for random-looking domains). (Source: Bell Integration baseline detection library, mapped via sub-technique T1568.002.)",
        "query": "let TrustedDomains = dynamic([\n    \"microsoft.com\", \"windows.com\", \"office.com\", \"azure.com\", \"google.com\",\n    \"amazonaws.com\", \"akamai.com\", \"cloudflare.com\", \"digicert.com\"\n]);\nlet Tunnelling = (\n    DeviceNetworkEvents\n    | where TimeGenerated >= ago(1h)\n    | where ActionType == \"DnsQueryResponse\"\n    | where not(RemoteUrl has_any (TrustedDomains))\n    | extend DomainLen = strlen(RemoteUrl)\n    | where DomainLen > 50 or RemoteUrl matches regex @\"[a-z0-9]{20,}\\.\"\n    | summarize QueryCount = count(), UniqueDomains = dcount(RemoteUrl), SampleDomains = make_set(RemoteUrl, 5)\n        by DeviceName, InitiatingProcessFileName\n    | where QueryCount > 30\n    | extend DetectionType = \"DNS_Tunnelling\"\n);\nlet DGA = (\n    DeviceNetworkEvents\n    | where TimeGenerated >= ago(1h)\n    | where ActionType == \"ConnectionFailed\"\n    | where not(RemoteUrl has_any (TrustedDomains))\n    | summarize FailCount = count(), UniqueDomains = dcount(RemoteUrl), SampleDomains = make_set(RemoteUrl, 5)\n        by DeviceName, InitiatingProcessFileName\n    | where FailCount > 100 and UniqueDomains > 50\n    | extend DetectionType = \"DGA_Pattern\"\n);\nTunnelling\n| union DGA\n| extend timestamp = now(), HostCustomEntity = DeviceName\n| order by QueryCount desc"
      },
      {
        "name": "6b61b716-afd9-4f6c-ad00-965d5987cafd — CYFIRMA - High severity Command & Control Network Indicators with Block Recommendation Rule",
        "description": "\"This analytics rule detects network-based indicators identified by CYFIRMA threat intelligence as associated with Command & Control (C2) infrastructure. These may represent attacker-controlled endpoints used to maintain persistence, exfiltrate data, or receive commands from malware-infected hosts.\" (Source: Microsoft's official Azure-Sentinel Detections (MIT licensed), mapped via sub-technique T1568.002.)",
        "query": "// Network Indicators query with Block Recommended Action and C2 Roles\nlet timeFrame= 5m;\nCyfirmaIndicators_CL \n| where ConfidenceScore >= 80\n    and TimeGenerated between (ago(timeFrame) .. now())\n    and pattern !contains 'file:hashes' and RecommendedActions has 'Block' and (Roles contains 'c2' or Roles contains 'Command & Control')\n| extend IPv4 = extract(@\"ipv4-addr:value\\s*=\\s*'([^']+)'\", 1, pattern)\n| extend IPv6 = extract(@\"ipv6-addr:value\\s*=\\s*'([^']+)'\", 1, pattern)\n| extend URL = extract(@\"url:value\\s*=\\s*'([^']+)'\", 1, pattern)\n| extend Domain = extract(@\"domain-name:value\\s*=\\s*'([^']+)'\", 1, pattern)\n| extend parsed = parse_json(extensions)\n| extend extensionKeys = bag_keys(parsed)\n| mv-expand extensionKeys\n| extend extensionKeyStr = tostring(extensionKeys)\n| extend ext = parsed[extensionKeyStr]\n| extend props = ext.properties\n| extend \n    extension_id = extensionKeyStr,\n    ASN_Owner = props.asn_owner,\n    ASN = props.asn,\n    ProviderName = 'CYFIRMA',\n    ProductName = 'DeCYFIR/DeTCT'\n| project\n    IPv4,\n    IPv6,\n    URL,\n    Domain,\n    ThreatActors,\n    RecommendedActions,\n    Sources,\n    Roles,\n    Country,\n    IPAbuse,\n    name,\n    Description,\n    ConfidenceScore,\n    IndicatorID,\n    created,\n    modified,\n    valid_from,\n    Tags,\n    ThreatType,\n    TimeGenerated,\n    SecurityVendors,\n    ProductName,\n    ProviderName"
      },
      {
        "name": "6d8fb3fe-2501-4103-8137-34261fa3a596 — CYFIRMA - High severity Command & Control Network Indicators with Monitor Recommendation Rule",
        "description": "\"This analytics rule detects network-based indicators identified by CYFIRMA threat intelligence as associated with Command & Control (C2) infrastructure. These may represent attacker-controlled endpoints used to maintain persistence, exfiltrate data, or receive commands from malware-infected hosts.\" (Source: Microsoft's official Azure-Sentinel Detections (MIT licensed), mapped via sub-technique T1568.002.)",
        "query": "// Network Indicators query with Monitor Recommended Action And C2 Roles\nlet timeFrame= 5m;\nCyfirmaIndicators_CL \n| where ConfidenceScore >= 80\n    and TimeGenerated between (ago(timeFrame) .. now())\n    and pattern !contains 'file:hashes' and RecommendedActions has 'Monitor' and (Roles contains 'c2' or Roles contains 'Command & Control')\n| extend IPv4 = extract(@\"ipv4-addr:value\\s*=\\s*'([^']+)'\", 1, pattern)\n| extend IPv6 = extract(@\"ipv6-addr:value\\s*=\\s*'([^']+)'\", 1, pattern)\n| extend URL = extract(@\"url:value\\s*=\\s*'([^']+)'\", 1, pattern)\n| extend Domain = extract(@\"domain-name:value\\s*=\\s*'([^']+)'\", 1, pattern)\n| extend parsed = parse_json(extensions)\n| extend extensionKeys = bag_keys(parsed)\n| mv-expand extensionKeys\n| extend extensionKeyStr = tostring(extensionKeys)\n| extend ext = parsed[extensionKeyStr]\n| extend props = ext.properties\n| extend \n    extension_id = extensionKeyStr,\n    ASN_Owner = props.asn_owner,\n    ASN = props.asn,\n    ProviderName = 'CYFIRMA',\n    ProductName = 'DeCYFIR/DeTCT'\n| project\n    IPv4,\n    IPv6,\n    URL,\n    Domain,\n    ThreatActors,\n    RecommendedActions,\n    Sources,\n    Roles,\n    Country,\n    IPAbuse,\n    name,\n    Description,\n    ConfidenceScore,\n    IndicatorID,\n    created,\n    modified,\n    valid_from,\n    Tags,\n    ThreatType,\n    TimeGenerated,\n    SecurityVendors,\n    ProductName,\n    ProviderName"
      }
    ],
    "spl": [],
    "esql": [
      {
        "name": "cf53f532-9cc9-445a-9ae7-fced307ec53c — Cobalt Strike Command and Control Beacon",
        "description": "(ESQL) Cobalt Strike is a threat emulation platform commonly modified and used by adversaries to conduct network attack and exploitation campaigns. This rule detects a network activity algorithm leveraged by Cobalt Strike implant beacons for command and control. (Source: Elastic's official detection-rules repository (Elastic License v2).)",
        "query": "from packetbeat-*, filebeat-*, logs-network_traffic.* metadata _id, _version, _index\n| where (\n    (event.category in (\"network\", \"network_traffic\") and network.protocol in (\"tls\", \"http\")) or\n    data_stream.dataset in (\"network_traffic.tls\", \"network_traffic.http\")\n  )\n| where destination.domain RLIKE \"[a-z]{3}\\\\.stage\\\\.[0-9]{8}\\\\..*\"\n| keep @timestamp, destination.domain, source.ip, destination.ip, network.protocol, data_stream.dataset, _id, _version, _index"
      },
      {
        "name": "4a4e23cf-78a2-449c-bac3-701924c269d3 — Possible FIN7 DGA Command and Control Behavior",
        "description": "(ESQL) This rule detects a known command and control pattern in network events. The FIN7 threat group is known to use this command and control technique, while maintaining persistence in their target's network. (Source: Elastic's official detection-rules repository (Elastic License v2).)",
        "query": "from packetbeat-*, filebeat-*, logs-network_traffic.*, logs-panw.panos* metadata _id, _version, _index\n| where (\n    data_stream.dataset in (\"network_traffic.tls\", \"network_traffic.http\") or\n    (event.category in (\"network\", \"network_traffic\") and network.protocol in (\"tls\", \"http\") and network.transport == \"tcp\")\n  )\n| where destination.domain RLIKE \"[a-zA-Z]{4,5}\\\\.(pw|us|club|info|site|top)\"\n| where destination.domain != \"zoom.us\"\n| keep @timestamp, destination.domain, source.ip, destination.ip, network.protocol, network.transport, data_stream.dataset, _id, _version, _index"
      }
    ]
  },
  "automation": {
    "safe": [
      "Add recommendation as Sentinel incident comment.",
      "Run enrichment queries.",
      "Create ServiceNow SecOps task."
    ],
    "approval_required": [
      "Contain or disable the affected host/account.",
      "Any change to production configuration."
    ]
  },
  "escalation_criteria": [
    "Dynamic Resolution activity observed on a privileged account or critical system.",
    "Activity follows or precedes other suspicious behaviour in the same investigation.",
    "Automated triage cannot confidently rule out malicious intent."
  ],
  "false_positive_considerations": [
    "Legitimate administrative or maintenance activity matching this pattern.",
    "Approved security testing or red team exercise.",
    "Known benign software producing similar telemetry."
  ],
  "confluence": {
    "title": "T1568 - Dynamic Resolution Response Guidance",
    "labels": [
      "mitre",
      "attack",
      "d3fend",
      "secops",
      "basyrix"
    ],
    "sections": [
      "summary",
      "d3fend_mappings",
      "investigation_steps",
      "response_actions",
      "queries",
      "automation",
      "escalation_criteria",
      "false_positive_considerations"
    ]
  }
}