T1568No distinct observable

Dynamic Resolution

Command and ControlESXi, Linux, macOS, Windows

Where this stands

A reviewer read the telemetry and concluded there is nothing here to detect that a sibling technique does not already cover.

Every discriminator DET0039 offers is statistical, and the one shape that is expressible belongs to a child. AN0109 asks for 'high-frequency or anomalous DNS query activity' and 'pseudo-random or high-entropy domain lookups', with mutableElements EntropyThreshold and TimeWindow; AN0110 asks for 'repeated failed lookups' over a TimeWindow; AN0111 asks for 'repeated connections' plus domain registration age (NewDomainThreshold) and per-process DNSQueryVolume. Entropy scoring, per-process query counting, failed-lookup rates and domain-age enrichment all require aggregation, a time window, or an external feed — all four are outside the constructs lib/sigma models (no aggregations, no timeframes, no reputation joins). […]

Covered instead by T1568.001, T1568.002, T1568.003.

What the technique is

Adversaries may dynamically establish connections to command and control infrastructure to evade common detections and remediations. This may be achieved by using malware that shares a common algorithm with the infrastructure the adversary uses to receive the malware's communications. These calculations can be used to dynamically adjust parameters such as the domain name, IP address, or port number the malware uses for command and control. Adversaries may use dynamic resolution for the purpose of Fallback Channels. When contact is lost with the primary command and control server malware may employ dynamic resolution as a means to reestablishing command and control.

Read it on attack.mitre.org

What MITRE says you would watch

AN0109
Correlate high-frequency or anomalous DNS query activity with processes that do not normally generate network requests (e.g., Office apps, system utilities). Detect pseudo-random or high-entropy domain lookups indicative of domain generation algorithms (DGAs).
AN0110
Monitor /var/log/audit/audit.log and DNS resolver logs for repeated failed lookups or connections to high-entropy domain names. Correlate suspicious DNS queries with process lineage (e.g., Python, bash, or unusual system daemons).
AN0111
Inspect unified logs for anomalous DNS resolutions triggered by non-network applications. Flag repeated connections to newly registered or algorithmically generated domains. Correlate with endpoint process telemetry.