Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in User Guide
Log in Get started
Detection Strategies DET0039 — Detection Strategy for Dynamic Resolution across OS Platforms
DET0039

Detection Strategy for Dynamic Resolution across OS Platforms

4 analytic(s) · 1 technique(s) detected

Analytics

4
AN0109 Analytic 0109
Windows

Correlate high-frequency or anomalous DNS query activity with processes that do not normally generate network requests (e.g., Office apps, system utilities). Detect pseudo-random or high-entropy domain lookups indicative of domain generation algorithms (DGAs).

WinEventLog:Sysmon EventCode=3, 22 WinEventLog:Sysmon EventCode=1
[EntropyThreshold] Adjust based on environment to differentiate DGAs from legitimate CDNs
[TimeWindow] Interval for correlating bursts of DNS queries from the same process
AN0110 Analytic 0110
Linux

Monitor /var/log/audit/audit.log and DNS resolver logs for repeated failed lookups or connections to high-entropy domain names. Correlate suspicious DNS queries with process lineage (e.g., Python, bash, or unusual system daemons).

auditd:SYSCALL socket/connect linux:syslog Query to suspicious domain with high entropy or low reputation
[DomainReputationFeed] Whitelist/blacklist tuned with external threat intel sources
[ProcessWhitelist] Known safe daemons that frequently query domains
AN0111 Analytic 0111
macOS

Inspect unified logs for anomalous DNS resolutions triggered by non-network applications. Flag repeated connections to newly registered or algorithmically generated domains. Correlate with endpoint process telemetry.

macos:unifiedlog DNS query with pseudo-random subdomain patterns macos:unifiedlog Unexpected applications generating outbound DNS queries
[NewDomainThreshold] Age of domain registration considered suspicious (e.g., < 30 days)
[DNSQueryVolume] Number of queries per process per time window
AN0112 Analytic 0112
ESXi

Monitor esxcli and syslog records for DNS resolver changes or repeated queries to unusual external domains by management agents. Detect unauthorized changes to VM or host network settings that redirect DNS lookups.

esxi:syslog esxcli network vswitch or DNS resolver configuration updates
[ResolverConfigPaths] Expected resolvers or DNS forwarders in ESXi configurations
[ExternalDomainWhitelist] Set of trusted external domains expected for ESXi host activity

Detected Techniques

1

Command & Control (1)

Details

MITRE ID
DET0039
STIX ID
x-mitre-detection-strategy--98d6523f-54c5-4a24-a758-333caa833967
Analytics
4
Techniques Detected
1
By Tactic
Command & Control
1
Leaving Threaticon

This link opens an external site that isn't part of the platform.