TA0011 · COMMAND AND CONTROL
DNS Calculation
Adversaries may perform calculations on addresses returned in DNS results to determine which port and IP address to use for command and control, rather than relying on a predetermined port number or the actual returned IP address.
Detect it with
Detection for this technique is difficult because it would require knowledge of the specific implementation of the port calculation algorithm. Detection may be possible by analyzing DNS records if the algorithm is known.
Why it matters on shift
DNS Calculation is one of the concrete ways adversaries achieve command and control. Recognising it in telemetry lets you name the technique in your ticket and pivot to what came before and after.
What to look for next
After command and control, the next tactic is usually Exfiltration. Search your telemetry for the transition before closing the ticket.
Kill-chain context