A blocklist of known bad domains loses to malware that can make up thousands of new ones. MITRE T1568.002, Domain Generation Algorithms, describes exactly that. It falls under command and control and applies to ESXi, Linux, macOS and Windows.
How attackers use it
A domain generation algorithm, or DGA, lets malware work out a destination domain for command and control instead of using a fixed list of IPs or domains. MITRE notes this makes the channel much harder to block, track or take over, since there may be thousands of domains to check.
Some DGAs build gibberish strings letter by letter, such as istgmxdejdnxuyla.ru. Others join whole words, such as cityjulydish.net. Many are time-based, producing a different domain per hour, day or month, and some add a seed to make future domains harder to predict. DGAs also serve as a fallback channel when contact with the primary server is lost.
How to detect it
The signal is in DNS behavior, tied to the process behind it:
- Windows: queries for high-entropy or gibberish domains, short-lived connections from unusual processes, abnormal query rates and many failed lookups, in Sysmon DNS events and Windows Security logs.
- Linux: repeated queries to random-looking domains or word concatenations, with high NXDOMAIN rates, correlated with auditd socket connections.
- macOS: queries with low lexical similarity to known domains, repeated failed lookups, and non-browser origins.
- ESXi: high-frequency, low-TTL or unresolvable domains from management agents.
A host with a burst of NXDOMAIN answers for unrelated random names is worth a look.
How to reduce the risk
MITRE lists two mitigations. Network intrusion prevention with signatures for specific malware can help, and researchers can sometimes reverse engineer a sample to predict future domains, but MITRE calls that time and resource intensive. Restricting web-based content with a local DNS sinkhole can prevent DGA-based command and control at a reduced cost.
Check your own environment
- Do resolver logs record the querying host and, where possible, the process?
- Can you report NXDOMAIN rate per host per hour?
- Is Sysmon event 22 collected on Windows endpoints and servers?
Quick check
Why do defenders struggle to block DGA traffic?
There may be thousands of candidate domains, often changing by time period, so a static blocklist cannot keep up.
