Adversaries may dynamically establish connections to command and control infrastructure to evade common detections and remediations. This may be achieved by using malware that shares a common algorithm with the infrastructure the adversary uses to receive the malware's communications. These calculations can be used to dynamically adjust parameters such as the domain name, IP address, or port number the malware uses for command and control.

Adversaries may use dynamic resolution for the purpose of [Fallback Channels](https://attack.mitre.org/techniques/T1008). When contact is lost with the primary command and control server malware may employ dynamic resolution as a means to reestablishing command and control.(Citation: Talos CCleanup 2017)(Citation: FireEye POSHSPY April 2017)(Citation: ESET Sednit 2017 Activity)
Dynamic Resolution
source_name: mitre-attack  url: https://attack.mitre.org/techniques/T1568  external_id: T1568     source_name: Talos CCleanup 2017  description: Brumaghin, E. et al. (2017, September 18). CCleanup: A Vast Number of Machines at Risk. Retrieved March 9, 2018.  url: http://blog.talosintelligence.com/2017/09/avast-distributes-malware.html     source_name: FireEye POSHSPY April 2017  description: Dunwoody, M.. (2017, April 3). Dissecting One of APT29’s Fileless WMI and PowerShell Backdoors (POSHSPY). Retrieved April 5, 2017.  url: https://www.fireeye.com/blog/threat-research/2017/03/dissecting_one_ofap.html     source_name: ESET Sednit 2017 Activity  description: ESET. (2017, December 21). Sednit update: How Fancy Bear Spent the Year. Retrieved February 18, 2019.  url: https://www.welivesecurity.com/2017/12/21/sednit-update-fancy-bear-spent-year/     source_name: Data Driven Security DGA  description: Jacobs, J. (2014, October 2). Building a DGA Classifier: Part 2, Feature Engineering. Retrieved February 18, 2019.  url: https://datadrivensecurity.info/blog/posts/2014/Oct/dga-part2/     