Dead Drop Resolver

Dead Drop Resolver: Technique in which public services are exploited to dynamically determine C2 addresses. The term is relevant to the assessment and design of modern security architecturesSecurity ArchitectureThe structured design of security controls, trust boundaries, data flows, and operational responsibilities. and should be applied within the specific technical and organizational context.

How it works and where it fits

Dead Drop Resolver structures knowledge about potential adversaries, their objectives, capabilities, infrastructure, and observed behavior. Individual indicators are short-lived and easy to change, while behavioral patterns and technical relationships often have greater analytical value. Reporting should distinguish observed facts, assessments, and assumptions.

Practical security relevance

Practical use depends on source quality, timeliness, and relevance to the organization’s own attack surface. Information is prioritized, correlated with internal data, and converted into searches, detections, or safeguards. Investigation feedback continuously improves the assessment. Confidentiality and permitted sharing are as important as technical exchange formats.

Related concepts

• Command and ControlCommand and ControlCommunication infrastructure used by attackers to control compromised systems.: Communication infrastructure used by attackers to control compromised systems.
• Fast FluxFast FluxTechnique in which domains are mapped to rapidly changing IP addresses to obfuscate infrastructure.: Technique in which domains are mapped to rapidly changing IP addresses to obfuscate infrastructure.
• BeaconingBeaconingRegular communication between a compromised system and a command-and-control infrastructure.: Regular communication between a compromised system and a command-and-control infrastructure.
• OPSECOPSECThe discipline of protecting critical information by controlling the traces and clues an adversary could collect.: The discipline of protecting critical information by controlling the traces and clues an adversary could collect.