Clankerusecase
MITRE ATT&CK detection coverage
 ← Back to main site
Home/ MITRE Matrix/ Command and Control/ T1568

T1568Dynamic Resolution

T1568 — Dynamic Resolution is a MITRE ATT&CK technique in the Command and Control tactic. Clankerusecase tracks 14 detection use cases covering it and 14 threat-intel articles citing it.

Command and Control
View on the matrix → Filter Detection Library MITRE official spec ↗
14Use cases
14Articles
3Sub-techniques
1Tactic

Sub-techniques (3)

T1568.003 · DNS CalculationT1568.002 · Domain Generation AlgorithmsT1568.001 · Fast Flux DNS

Use cases covering this technique (14)

[LLM] Dysphoria botnet blockchain C2 resolution via ENS/SNS (.eth/.sol) domains Bespoke c2 · alerting DSΣPDDCS [LLM] Endpoint traffic to ACR Stealer C2 / dead-drop domains Bespoke c2 · alerting DSΣPDDCS [LLM] Blockchain-anchored C2 fallback: non-browser process contacting polygon-rpc.com Bespoke c2 · alerting DSΣPDDCS [LLM] C2 beacon to audit.checkmarx[.]cx /v1/telemetry (TeamPCP Shai-Hulud Third Coming) Bespoke c2 · alerting DSΣPDDCS [LLM] Outbound DNS / HTTP to Miasma C2 (git-service.com / m-kosche.com) Bespoke c2 · alerting DSΣPDDCS [LLM] node-ipc C2 callback to sh.azurestaticprovider.net (May 2026 npm supply-chain) Bespoke c2 · alerting DSΣPDDCS [LLM] Mini Shai-Hulud npm Worm C2 callback to Session Protocol CDN and masscan.cloud Bespoke c2 · alerting DSΣPDDCS [LLM] axios Supply Chain RAT C2 Callback to sfrclak.com (Port 8000) Bespoke c2 · alerting DSΣPDDCS [LLM] C2 beaconing to Vercel-hosted Cloudflare-impersonating domains (cloudflareguard / cloudflareinsights) Bespoke c2 · alerting DSΣPDD [LLM] Egress to Qix npm phishing/exfil infrastructure (npmjs.help, publicvm.com, BunnyCDN buckets) Bespoke c2 · hunting DSΣPDDCS [LLM] Scavenger npm malware C2 beacon to firebase.su / dieorsuffer.com / smartscreen-api.com Bespoke c2 · alerting DSΣPDD [LLM] Beamglea mad-* dead-drop fetch from raw.githubusercontent.com/Abassdos2992 Bespoke c2 · alerting DSΣPDDCS [LLM] Scavenger Stealer C2 beacon to corroborated infrastructure (datahog.su / datalytica.su / smartscreen-api.com) Bespoke c2 · alerting DSΣPDDCS [LLM] Egress to Solidity Language Cursor extension C2 infrastructure (angelic.su / lmfao.su / staketree.net / ab498.pythonanywhere.com / 144.172.1 Bespoke c2 · hunting DSΣPDDCS

Articles citing this technique (14)

crit Dysphoria IoT Botnet Adds Blockchain C2 and Victim Relays After JackSkid Disruption art-58
high ACR Stealer: Two observed intrusion chains amid increased threat activity art-146
crit Begun, the Patch Wars have art-150
crit The npm Threat Landscape: Attack Surface and Mitigations (Updated July 15) art-163
high Miasma Worm Hits Microsoft Again: Azure Functions Action and 72 Other Repositories Disabled After Supply Chain Attack Targeting AI Coding Ag art-351
crit Active Supply Chain Attack: Malicious node-ipc Versions Published to npm art-427
crit TeamPCP's Mini Shai-Hulud Is Back: A Self-Spreading Supply Chain Attack Compromises TanStack npm Packages art-437
crit axios Compromised on npm - Malicious Versions Drop Remote Access Trojan art-523
crit Malicious Polymarket Bot Hides in Hijacked dev-protocol GitHub Org and Steals Wallet Keys art-555
high 20+ Popular NPM Packages Compromised (Chalk, Debug, Strip-ANSI, Color-Convert, Wrap-ANSI...) art-640
crit Another npm Supply Chain Attack: The 'is' Package Compromise art-654
crit Phishing Campaign Leveraging the NPM Ecosystem art-823
crit Maintainers of ESLint Prettier Plugin Attacked via npm Supply Chain Malware art-894
high Cursor IDE Malware Extension Compromise in $500k Crypto Heist art-900