T1568.003No distinct observable

DNS Calculation

Command and ControlESXi, Linux, macOS, Windows

Where this stands

A reviewer read the telemetry and concluded there is nothing here to detect that a sibling technique does not already cover.

The defining observable is arithmetic performed across two events, which lib/sigma cannot express in any form. The technique is 'take the first three octets of an IP address in a DNS response and use those values to calculate the port for command and control': proving it requires reading QueryResults from a Sysmon EventID 22 record, computing a value from it, and comparing that value to DestinationPort on a later EventID 3 record. That is a cross-event join plus a numeric computation plus a correlation window — AN0728 says so directly ('correlate Sysmon DNS logs (Event ID 22) with process creation and socket activity') and both of its knobs are the correlation, not a filter: TimeWindow is 'correlation window between DNS response and network connection (e.g., 5 minutes)' and PortDeviationThreshold is 'deviation from common service ports (e.g., >1024 when DNS resolved service expects 80/44 […]

Covered instead by T1568, T1568.002, T1571, T1090.

What the technique is

Adversaries may perform calculations on addresses returned in DNS results to determine which port and IP address to use for command and control, rather than relying on a predetermined port number or the actual returned IP address. A IP and/or port number calculation can be used to bypass egress filtering on a C2 channel. One implementation of DNS Calculation is to take the first three octets of an IP address in a DNS response and use those values to calculate the port for command and control traffic.

Read it on attack.mitre.org

What MITRE says you would watch

AN0728
Monitor DNS query results where subsequent connections use derived or unusual port numbers not explicitly resolved, especially when tied to suspicious processes. Correlate Sysmon DNS logs (Event ID 22) with process creation and socket activity.
AN0729
Inspect resolver and audit logs for processes initiating outbound connections to ports calculated from DNS response IPs. Abnormal ephemeral port usage shortly after DNS queries can indicate DNS calculation behavior.
AN0730
Use unified logs to detect unusual DNS responses correlated with subsequent connections to calculated or non-standard ports. Monitor non-browser apps making repeated outbound connections that deviate from expected patterns.