Sign In
- Platform
- Solutions
- Modern NDR
- Resources
- Company
Platform
Modern NDR
Resources
Platform
Modern NDR
Resources
DETECTION OVERVIEW
Risk Factors
Domain generation algorithms (DGAs) that are associated with malware activity indicate a persistent, planned attack rather than a random attack. Malware that frequently updates a command-and-control (C&C) server domain name with DGA domain names requires a sophisticated setup and effective algorithms. These techniques can help an attacker maintain contact with a compromised device while evading intrusion detection systems.
The system might change the risk score for this detection.
Kill Chain
Risk Score
61
Attackers can install malware on a compromised device that periodically establishes connections from the device to an attacker-controlled C&C server. To avoid detection, the attacker frequently changes the C&C server domain name with the help of a DGA that is embedded into the malware. DGA domain names can be an unusual length, contain multiple vowels or consonants in a row, or include a random mix of letters, numbers, and top-level domains (TLD). Because the attacker knows how the algorithm works, the DGA domain name is easy to predict by the attacker but difficult to predict by network defenders.
Legitimate domains can appear similar to algorithmically generated domains; however, legitimate domains can be verified with a domain reputation service.
Quarantine the device while checking for malware
