{"id":"T1584.001","name":"Domains","url":"https://attack.mitre.org/techniques/T1584/001","tactics":["resource-development"],"platforms":["PRE"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0863","stix_id":"x-mitre-detection-strategy--dce8edf3-894f-4857-8f85-04db84bcebd9","name":"Detection of Domains","url":"https://attack.mitre.org/detectionstrategies/DET0863","analytics":[{"id":"AN1995","stix_id":"x-mitre-analytic--0cadbf9f-befa-4bd8-85b8-e5af53383953","name":"Analytic 1995","description":"Monitor for logged domain name system (DNS) registry data that may hijack domains and/or subdomains that can be used during targeting.  In some cases, abnormal subdomain IP addresses (such as those originating in a different country from the root domain) may indicate a malicious subdomain.(Citation: Palo Alto Unit 42 Domain Shadowing 2022) Much of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Command and Control.\nConsider monitoring for anomalous changes to domain registrant information and/or domain resolution information that may indicate the compromise of a domain. Efforts may need to be tailored to specific domains of interest as benign registration and resolution changes are a common occurrence on the internet.\nMonitor for queried domain name system (DNS) registry data that may hijack domains and/or subdomains that can be used during targeting. In some cases, abnormal subdomain IP addresses (such as those originating in a different country from the root domain) may indicate a malicious subdomain.(Citation: Palo Alto Unit 42 Domain Shadowing 2022) Much of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Command and Control.","url":"https://attack.mitre.org/detectionstrategies/DET0863#AN1995","platforms":["PRE"],"log_source_references":[{"name":"Domain Name","channel":"None","data_component":"DC0096","data_component_name":"Passive DNS","log_source_slug":"domain-name"},{"name":"Domain Name","channel":"None","data_component":"DC0101","data_component_name":"Domain Registration","log_source_slug":"domain-name"},{"name":"Domain Name","channel":"None","data_component":"DC0103","data_component_name":"Active DNS","log_source_slug":"domain-name"}],"mutable_elements":[],"live":true,"detection_strategies":["DET0863"],"techniques":["T1584.001"]}],"live":true,"version":"1.0","techniques":["T1584.001"]}],"sigma_rules":[],"kev_cves":[],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}