Techniques › T1665 › AN1148
AN1148 Analytic 1148
Windows · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Monitor DNS queries, proxy logs, and user-agent strings for anomalous patterns associated with adversary attempts to hide infrastructure. Defenders may observe DNS resolutions to short-lived domains, abnormal WHOIS registration data, or filtering of known defensive/responder IP addresses.</p>
- Detects
- T1665 Hide Infrastructure
- Part of
- DET0411 Detection Strategy for Hide Infrastructure
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| WinEventLog:Security | EventCode=5156, 5157 | DC0082 Network Connection Creation |
| dns:query | Excessive lookups for domains with suspicious WHOIS or short TTL values | DC0101 Domain Registration |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
SuspiciousDomains | List of domains registered with privacy-protected or suspicious WHOIS metadata. |
ResponderIPs | Known incident response or scanning infrastructure IP ranges. |