Sign In
- Platform
- Solutions
- Modern NDR
- Resources
- Company
Platform
Modern NDR
Resources
Platform
Modern NDR
Resources
DETECTION OVERVIEW
Risk Factors
Domain generation algorithms (DGAs) are typically associated with malware. For the malware to successfully connect to the attacker-controlled command-and-control (C&C) server and receive instructions, the attacker must register several seemingly random DGA domain names. Often, DNS queries for DGA domains are unsuccessful because it takes many attempts for the malware to successfully resolve the registered domain name.
The system might change the risk score for this detection.
Kill Chain
Risk Score
38
Attackers can install malware on a compromised device that periodically establishes connections from the device to an attacker-controlled C&C server. To avoid detection, the attacker frequently changes the C&C server domain name with the help of a DGA that is embedded into the malware. DGA domain names can be an unusual length, contain multiple vowels or consonants in a row, or include a random mix of letters, numbers, and top-level domains (TLD). Because the attacker knows how the algorithm works, the DGA domain name is easy to predict by the attacker but difficult to predict by network defenders.
Legitimate domains can appear similar to algorithmically generated domains; however, legitimate domains can be verified with a domain reputation service.
Quarantine the device while checking for indicators of compromise, such as malware
