T1568.002 Dynamic Resolution: Domain Generation Algorithms — cross-source coverage

From MITRE ATT&CK 19.2

Adversaries may make use of Domain Generation Algorithms (DGAs) to dynamically identify a destination domain for command and control traffic rather than relying on a list of static IP addresses or domains. This has the advantage of making it much harder for defenders to block, track, or take over the command and control channel, as there potentially could be thousands of domains that malware can check for instructions.

DGAs can take the form of apparently random or “gibberish” strings (ex: istgmxdejdnxuyla.ru) when they construct domain names by generating each letter. Alternatively, some DGAs employ whole words as the unit by concatenating words together instead of letters (ex: cityjulydish.net). Many DGAs are time-based, generating a different domain for each time period (hourly, daily, monthly, etc). Others incorporate a seed value as well to make predicting future domains more difficult for defenders.

Adversaries may use DGAs for the purpose of Fallback Channels. When contact is lost with the primary command and control server malware may employ a DGA as a means to reestablishing command and control.

Tactics

Command and Control

Platforms

ESXi · Linux · macOS · Windows

Telemetry

WinEventLog:SysmonWinEventLog:Securityauditd:SYSCALLlinux:syslogmacos:unifiedlogesxi:syslog

How MITRE says to detect it DET0419

Detection Strategy for Dynamic Resolution using Domain Generation Algorithms.

Windows Analytic 1178

Correlate DNS queries that generate domains with high entropy or gibberish patterns, combined with short-lived connections from unusual processes. Monitor Sysmon DNS events and Windows Security logs for abnormal query rates and failed lookups.

WinEventLog:Sysmon EventCode=3, 22
WinEventLog:Security EventCode=4688

Linux Analytic 1179

Identify processes issuing repeated DNS queries to random-looking domains with abnormal entropy or word concatenations. Correlate resolver logs with high NXDOMAIN rates and auditd socket connections.

auditd:SYSCALL socket/connect
linux:syslog Multiple NXDOMAIN responses and high entropy domains

macOS Analytic 1180

Monitor unified DNS logs for abnormal domain queries with low lexical similarity to known domains, repeated failed lookups, and random string structures. Cross-check with process logs to confirm unusual origins (non-browser apps).

macos:unifiedlog High entropy domain queries with multiple NXDOMAINs
macos:unifiedlog Unexpected apps performing repeated DNS lookups

ESXi Analytic 1181

Use ESXi syslogs to track abnormal DNS query patterns from management agents or VMs. Identify high-frequency, low-TTL, or unresolvable domains as suspicious. Correlate with unusual management plane process activity.

esxi:syslog Frequent DNS queries with high entropy names or NXDOMAIN results

Detection	Severity	Format
Cobalt Strike Command and Control Beacon	High	Elastic TOML
Halfbaked Command and Control Beacon	High	Elastic TOML
Machine Learning Detected DGA activity using a known SUNBURST DNS domain	High	Elastic TOML
Possible FIN7 DGA Command and Control Behavior	High	Elastic TOML
Connection to Commonly Abused Web Services	Low	Elastic TOML
DNS Request to Suspicious Top Level Domain	Low	Elastic TOML
Machine Learning Detected a DNS Request Predicted to be a DGA Domain	Low	Elastic TOML
Machine Learning Detected a DNS Request With a High DGA Probability Score	Low	Elastic TOML
Potential DGA Activity	Low	Elastic TOML

Detection

Severity

Format

Cobalt Strike Command and Control Beacon

High

Elastic TOML

Halfbaked Command and Control Beacon

High

Elastic TOML

Machine Learning Detected DGA activity using a known SUNBURST DNS domain

High

Elastic TOML