Dynamic Resolution
Technique · ATTACK:enterprise:T1568
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1568",
"title": "Dynamic Resolution",
"type": "Technique",
"source_url": "https://attack.mitre.org/techniques/T1568",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--7bd9c723-2f78-4309-82c5-47cad406572b",
"external_id": "T1568",
"domain": "enterprise",
"created": "2020-03-10T17:28:11.747Z",
"modified": "2026-05-12T15:12:00.644Z",
"version": "1.1",
"aliases": [
],
"tactics": [
"command-and-control"
],
"source_references": [
{
"source_name": "Talos CCleanup 2017",
"url": "http://blog.talosintelligence.com/2017/09/avast-distributes-malware.html"
},
{
"source_name": "FireEye POSHSPY April 2017",
"url": "https://www.fireeye.com/blog/threat-research/2017/03/dissecting_one_ofap.html"
},
{
"source_name": "ESET Sednit 2017 Activity",
"url": "https://www.welivesecurity.com/2017/12/21/sednit-update-fancy-bear-spent-year/"
},
{
"source_name": "Data Driven Security DGA",
"url": "https://datadrivensecurity.info/blog/posts/2014/Oct/dga-part2/"
}
]
}Explicit source assertions (29)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0671 → uses → ATTACK:enterprise:T1568
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--03f288cd-a189-4de9-abd4-6b10bda138a4
Kaspersky Tomiris Sep 2021ATTACK:enterprise:G1042 → uses → ATTACK:enterprise:T1568
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--067b9dbb-a5fc-4d41-9dcb-ee909e0938f7
RecordedFuture RedEcho 2021ATTACK:enterprise:S0666 → uses → ATTACK:enterprise:T1568
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0869b511-3211-4f90-86fa-d145fa42cc3a
ESET Gelsemium June 2021ATTACK:enterprise:M1031 → mitigates → ATTACK:enterprise:T1568
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0c2dadcb-36c4-4255-a53d-e54f1bb71c5f
Cybereason Dissecting DGAs · Cisco Umbrella DGA Brute ForceATTACK:enterprise:C0005 → uses → ATTACK:enterprise:T1568
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1e04ed60-7e43-4bad-a4c2-462b0b001dda
ESET Operation Spalax Jan 2021ATTACK:enterprise:G1018 → uses → ATTACK:enterprise:T1568
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--20e1f501-0932-40d2-a41b-386a8b9d463d
Proofpoint TA2541 February 2022ATTACK:enterprise:G0134 → uses → ATTACK:enterprise:T1568
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--23041edc-3136-49b7-8d08-311321455aa7
Proofpoint Operation Transparent Tribe March 2016ATTACK:enterprise:G1002 → uses → ATTACK:enterprise:T1568
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--24fadb92-7a18-450b-b4ca-f5dd019ce54c
Forcepoint BITTER Pakistan Oct 2016ATTACK:enterprise:S0148 → uses → ATTACK:enterprise:T1568
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--25eb9cd3-80e1-4116-bfd3-fa3819dc2079
CheckPoint Redaman October 2019 · Unit42 Redaman January 2019ATTACK:enterprise:G0016 → uses → ATTACK:enterprise:T1568
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2c57efb7-0a7a-4b75-bbe1-e6f243713bee
Mandiant APT29 Eye Spy Email Nov 22ATTACK:enterprise:T1568.001 → subtechnique-of → ATTACK:enterprise:T1568
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--378b19ca-8f2f-4ede-a493-8daf14c16342
ATTACK:enterprise:T1568.002 → subtechnique-of → ATTACK:enterprise:T1568
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3a53c211-191a-4953-8fab-159077bb89f8
ATTACK:enterprise:S0034 → uses → ATTACK:enterprise:T1568
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--406afc1a-4ea7-45c5-b137-7784f9ed53f3
FireEye APT30ATTACK:enterprise:M1021 → mitigates → ATTACK:enterprise:T1568
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5632a2de-e231-4ef0-971b-6cdb2750d410
ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:T1568
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--67cf9a5c-3ecf-4280-9808-a027680f7444
Volexity SolarWindsATTACK:enterprise:S0449 → uses → ATTACK:enterprise:T1568
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6a521aa4-d389-4ef4-bd24-442d8af23333
McAfee Maze March 2020ATTACK:enterprise:S1087 → uses → ATTACK:enterprise:T1568
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6a56f549-3835-4f1f-8ece-fb8400f04432
AsyncRAT GitHubATTACK:enterprise:C0026 → uses → ATTACK:enterprise:T1568
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6d550704-4ccb-485b-8e79-519d13768afa
Mandiant Suspected Turla Campaign February 2023ATTACK:enterprise:G0094 → uses → ATTACK:enterprise:T1568
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--74554e53-92bd-4707-8e1a-ae3904ec935e
NaumaanProofpoint_GlobalClickFix_April2025ATTACK:enterprise:T1568.003 → subtechnique-of → ATTACK:enterprise:T1568
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7bf67f44-6349-4576-8145-44e53a91676a
ATTACK:enterprise:C0043 → uses → ATTACK:enterprise:T1568
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9587c895-a6be-46af-ad04-3844caf6998c
RecordedFuture RedEcho 2021ATTACK:enterprise:S9015 → uses → ATTACK:enterprise:T1568
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b804627f-f89d-442d-bcea-15c21b1508b6
Google BRICKSTORM September 2025ATTACK:enterprise:C0016 → uses → ATTACK:enterprise:T1568
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b965ddc5-3017-4857-9a3d-44aaf24b6bfd
Cylance Dust StormATTACK:enterprise:S0332 → uses → ATTACK:enterprise:T1568
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c3f01b1a-82c8-416c-9416-6b8469c89e65
Check Point Blind Eagle MAR 2025ATTACK:enterprise:G0099 → uses → ATTACK:enterprise:T1568
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d7647e3e-d554-44e0-97e0-b8d5abab3cab
Check Point Blind Eagle MAR 2025 · Kaspersky BlindEagle AUG 2024 · Recorded Future TAG-144 AUG 2025 · LevelBlue Blind Eagle Proton66 JUN 2025 · Zscaler BlindEagle DEC 2025ATTACK:enterprise:S0268 → uses → ATTACK:enterprise:T1568
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e101388f-ea73-4d02-b07f-c89a17dfa4a5
Talos Bisonal Mar 2020ATTACK:enterprise:G0047 → uses → ATTACK:enterprise:T1568
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--eb77b635-6f00-4975-b36e-63c7a5c48e3c
Unit 42 Gamaredon February 2022ATTACK:enterprise:C0002 → uses → ATTACK:enterprise:T1568
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ebe49c13-057f-4dc4-b04b-f19ac2480c4a
McAfee Night DragonATTACK:enterprise:S0559 → uses → ATTACK:enterprise:T1568
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f974cb59-0c30-43a3-bb3e-58ebc1007d6d
FireEye SUNBURST Backdoor December 2020