Techniques › T1568.001 › AN1331
AN1331 Analytic 1331
Windows · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Identify repeated DNS resolutions where the same domain name returns multiple IPs in short succession, combined with low TTL values and high query volume from unusual processes. Correlate with process lineage (e.g., Office apps spawning abnormal DNS lookups).</p>
- Detects
- T1568.001 Fast Flux DNS
- Part of
- DET0485 Detection Strategy for Dynamic Resolution using Fast Flux DNS
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| WinEventLog:Sysmon | EventCode=3, 22 | DC0082 Network Connection Creation |
| WinEventLog:Security | EventCode=1 | DC0032 Process Creation |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
DNSQueryBurstThreshold | Number of unique IPs returned per domain in a short window |
TimeWindow | Adjust correlation timeframe for fast flux detection (e.g., 5–10 minutes) |