ENTERPRISE MOBILE PRE-ATT&CK
TECHNIQUES
  1. Home
  2. Techniques
  3. Pre
  4. Dynamic DNS

Dynamic DNS

Dynamic DNS is a method of automatically updating a name in the DNS system. Providers offer this rapid reconfiguration of IPs to hostnames as a service. [1]

ID: T1311

Tactic: Adversary Opsec

Version: 1.0

Similar Techniques by Tactic

TacticTechnique
Establish & Maintain InfrastructureDynamic DNS

Examples

NameDescription
APT1

APT1 used dynamic DNS to register hundreds of FQDNs.[2]

Detection

Detectable by Common Defenses (Yes/No/Partial): No

Explanation: Defender will not know at first use what is valid or hostile traffic without more context. It is possible, however, for defenders to see if the PTR record for an address is hosted by a known DDNS provider. There is potential to assign some level of risk based on this.

Difficulty for the Adversary

Easy for the Adversary (Yes/No): Yes

Explanation: Flexible and re-configurable command and control servers, along with deniable ownership and reduced cost of ownership.

References

  1. DELL SECUREWORKS COUNTER THREAT UNIT THREAT INTELLIGENCE. (2012, September 18). The Mirage Campaign. Retrieved March 6, 2017.
  1. Mandiant. (n.d.). APT1 Exposing One of China’s Cyber Espionage Units. Retrieved July 18, 2016.