{"id":"T1568.003","name":"DNS Calculation","url":"https://attack.mitre.org/techniques/T1568/003","tactics":["command-and-control"],"platforms":["ESXi","Linux","macOS","Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0262","stix_id":"x-mitre-detection-strategy--510a02c8-4341-40ab-8b57-bd678c411ac0","name":"Detection Strategy for Dynamic Resolution through DNS Calculation","url":"https://attack.mitre.org/detectionstrategies/DET0262","analytics":[{"id":"AN0728","stix_id":"x-mitre-analytic--f47f256d-686f-4553-85e2-bd4d156da1e7","name":"Analytic 0728","description":"Monitor DNS query results where subsequent connections use derived or unusual port numbers not explicitly resolved, especially when tied to suspicious processes. Correlate Sysmon DNS logs (Event ID 22) with process creation and socket activity.","url":"https://attack.mitre.org/detectionstrategies/DET0262#AN0728","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Sysmon","channel":"EventCode=3, 22","data_component":"DC0082","data_component_name":"Network Connection Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=1","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-sysmon"}],"mutable_elements":[{"field":"PortDeviationThreshold","description":"Deviation from common service ports (e.g., >1024 when DNS resolved service expects 80/443)"},{"field":"TimeWindow","description":"Correlation window between DNS response and network connection (e.g., 5 minutes)"}],"live":true,"detection_strategies":["DET0262"],"techniques":["T1568.003"]},{"id":"AN0729","stix_id":"x-mitre-analytic--98f5c157-17c8-4ab8-943d-8d4c54dc3d6d","name":"Analytic 0729","description":"Inspect resolver and audit logs for processes initiating outbound connections to ports calculated from DNS response IPs. Abnormal ephemeral port usage shortly after DNS queries can indicate DNS calculation behavior.","url":"https://attack.mitre.org/detectionstrategies/DET0262#AN0729","platforms":["Linux"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"connect","data_component":"DC0082","data_component_name":"Network Connection Creation","log_source_slug":"auditd-syscall"},{"name":"linux:syslog","channel":"DNS response IPs followed by connections to non-standard calculated ports","data_component":"DC0085","data_component_name":"Network Traffic Content","log_source_slug":"linux-syslog"}],"mutable_elements":[{"field":"EphemeralPortRange","description":"Configured ephemeral port ranges per environment to reduce false positives"},{"field":"ResolverWhitelist","description":"Exclude trusted resolvers or internal services from analysis"}],"live":true,"detection_strategies":["DET0262"],"techniques":["T1568.003"]},{"id":"AN0730","stix_id":"x-mitre-analytic--e95ed4e2-d6bc-4a6f-acbc-bdbfcbaca158","name":"Analytic 0730","description":"Use unified logs to detect unusual DNS responses correlated with subsequent connections to calculated or non-standard ports. Monitor non-browser apps making repeated outbound connections that deviate from expected patterns.","url":"https://attack.mitre.org/detectionstrategies/DET0262#AN0730","platforms":["macOS"],"log_source_references":[{"name":"macos:unifiedlog","channel":"DNS responses followed by connections to ports outside standard ranges","data_component":"DC0085","data_component_name":"Network Traffic Content","log_source_slug":"macos-unifiedlog"},{"name":"macos:unifiedlog","channel":"Unexpected processes making network calls based on DNS-derived ports","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"macos-unifiedlog"}],"mutable_elements":[{"field":"ProcessAllowlist","description":"Expected processes allowed to open non-standard ports (e.g., developer tools)"},{"field":"ConnectionVolumeThreshold","description":"Volume of unusual connections needed before flagging as suspicious"}],"live":true,"detection_strategies":["DET0262"],"techniques":["T1568.003"]},{"id":"AN0731","stix_id":"x-mitre-analytic--18c20664-b820-4a14-a7bf-5a75ac2fae92","name":"Analytic 0731","description":"Analyze ESXi syslogs for management agents or VMs making outbound connections to dynamically calculated ports derived from DNS responses. Cross-check with VM traffic baselines to identify anomalies.","url":"https://attack.mitre.org/detectionstrategies/DET0262#AN0731","platforms":["ESXi"],"log_source_references":[{"name":"esxi:syslog","channel":"DNS resolution events leading to outbound traffic on unexpected ports","data_component":"DC0078","data_component_name":"Network Traffic Flow","log_source_slug":"esxi-syslog"}],"mutable_elements":[{"field":"ManagementPlaneIPs","description":"Known trusted ESXi management plane IPs to exclude from alerts"},{"field":"DomainReputationFeed","description":"Integrate external feeds for reputation context on DNS-derived domains"}],"live":true,"detection_strategies":["DET0262"],"techniques":["T1568.003"]}],"live":true,"version":"1.0","techniques":["T1568.003"]}],"sigma_rules":[],"kev_cves":[],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}