// MITRE ATT&CK
T1568.001 · Fast Flux DNS
Sub-técnica de T1568 · Dynamic Resolution.
Adversaries may use Fast Flux DNS to hide a command and control channel behind an array of rapidly changing IP addresses linked to a single domain resolution. This technique uses a fully qualified domain name, with multiple IP addresses assigned to it which are swapped with high frequency, using a c...
¿Cómo detectarlo y mitigarlo?
La detección de Fast Flux DNS parte de la telemetría de tu SIEM/EDR. Escribe una regla de detección con el generador Sigma, analiza logs sospechosos en el analizador de logs y sitúa la técnica en tu cobertura con la matriz ATT&CK.
Técnicas relacionadas
T1132.001
Standard Encoding T1568.002
Domain Generation Algorithms T1071.004
DNS T1071.005
Publish/Subscribe Protocols T1573.001
Symmetric Cryptography T1071
Application Layer Protocol T1219
Remote Access Tools T1572
Protocol Tunneling
Standard Encoding T1568.002
Domain Generation Algorithms T1071.004
DNS T1071.005
Publish/Subscribe Protocols T1573.001
Symmetric Cryptography T1071
Application Layer Protocol T1219
Remote Access Tools T1572
Protocol Tunneling
Fuente: MITRE ATT&CK®. ATT&CK es una marca registrada de The MITRE Corporation. Contenido con fines educativos.