Egress filtering assumes you know which ports a destination should use. MITRE T1568.003, DNS Calculation, breaks that assumption. It sits under command and control and applies to Linux, macOS, Windows and ESXi.
How attackers use it
Instead of a fixed port or the literal address returned, the malware performs a calculation on the IP address in a DNS result to decide which IP and port to use for command and control. MITRE gives one example: take the first three octets of the address in a DNS response and use those values to calculate the port. The result can bypass egress filtering that relies on expected port numbers.
How to detect it
Look for connections to derived or unusual ports that were never explicitly resolved, especially from suspicious processes. MITRE suggests correlating Sysmon DNS events (Event ID 22) with process creation and socket activity on Windows. On Linux, inspect resolver and audit logs for outbound connections to ports computed from DNS answers, since odd ephemeral port use shortly after a DNS query can be a clue. On macOS, use unified logs and watch non-browser apps making repeated connections that break their usual pattern. On ESXi, compare syslog with VM traffic baselines.
How to reduce the risk
MITRE lists no specific mitigation. Tight egress rules that allow only known destinations and ports, plus process-aware network logging, shrink the room such a channel has to hide.
Quick check
Which Sysmon event ties a DNS query to a process?
Event ID 22, DNS query. Correlate it with process creation and socket activity to see what connected next.
