T1568.001No distinct observable

Fast Flux DNS

Command and ControlLinux, macOS, Windows, ESXi

Where this stands

A reviewer read the telemetry and concluded there is nothing here to detect that a sibling technique does not already cover.

Fast flux is defined by change across a set of events, and every discriminator the strategy names is a count, a rate or a numeric threshold that lib/sigma cannot express. AN1331 asks for 'the same domain name returning multiple IPs in short succession, combined with low TTL values and high query volume', and its knobs are DNSQueryBurstThreshold ('number of unique IPs returned per domain in a short window') and TimeWindow; AN1332 asks for 'domains resolving to a rotating set of IPs within very short TTL intervals' with knobs TTLThreshold ('< 60 seconds') and DomainReputationFeed; AN1333 asks for 'resolved IP addresses that change frequently' with knobs DNSRotationRate and NewDomainThreshold ('registered < 30 days'). […]

Covered instead by T1568, T1568.002, T1568.003, T1071.004.

What the technique is

Adversaries may use Fast Flux DNS to hide a command and control channel behind an array of rapidly changing IP addresses linked to a single domain resolution. This technique uses a fully qualified domain name, with multiple IP addresses assigned to it which are swapped with high frequency, using a combination of round robin IP addressing and short Time-To-Live (TTL) for a DNS resource record. The simplest, "single-flux" method, involves registering and de-registering an addresses as part of the DNS A (address) record list for a single DNS name. These registrations have a five-minute average lifespan, resulting in a constant shuffle of IP address resolution. In contrast, the "double-flux" method registers and de-registers an address as part of the DNS Name Server record list for the DNS zone, providing additional resilience for the connection. With double-flux additional hosts can act as a proxy to the C2 host, further insulating the true source of the C2 channel.

Read it on attack.mitre.org

What MITRE says you would watch

AN1331
Identify repeated DNS resolutions where the same domain name returns multiple IPs in short succession, combined with low TTL values and high query volume from unusual processes. Correlate with process lineage (e.g., Office apps spawning abnormal DNS lookups).
AN1332
Monitor resolver logs and auditd events for domains resolving to a rotating set of IPs within very short TTL intervals. Correlate high query rates from non-browser applications (e.g., python, curl).
AN1333
Use unified logs to identify processes issuing repeated DNS queries where the resolved IP addresses change frequently within very short TTL values. Correlate with outbound network traffic to validate C2-like patterns.