Skip to content

DS0038 Domain Name

Information obtained (commonly through registration or activity logs) regarding one or more IP addresses registered with human readable names (ex: mitre.org)

Item Value
ID DS0038
Platforms PRE
Collection Layers OSINT
Version 1.0
Created 20 October 2021
Last Modified 20 October 2021

Data Components

Active DNS

Initial construction of a WMI object, such as a filter, consumer, subscription, binding, or provider (ex: Sysmon EIDs 19-21)

Domain ID Name
enterprise T1583 Acquire Infrastructure
enterprise T1583.001 Domains
enterprise T1584 Compromise Infrastructure
enterprise T1584.001 Domains
enterprise T1584.002 DNS Server

Domain Registration

Information about domain name assignments and other domain metadata (ex: WHOIS)

Domain ID Name
enterprise T1583 Acquire Infrastructure
enterprise T1583.001 Domains
enterprise T1584 Compromise Infrastructure
enterprise T1584.001 Domains

Passive DNS

Logged domain name system (DNS) data highlighting timelines of domain to IP address resolutions (ex: passive DNS)

Domain ID Name
enterprise T1583 Acquire Infrastructure
enterprise T1583.001 Domains
enterprise T1584 Compromise Infrastructure
enterprise T1584.001 Domains
enterprise T1584.002 DNS Server

References

Back to top