Potential DGA Activity Detected by Elastic Machine Learning
An Elastic machine learning rule detects potential Domain Generation Algorithm (DGA) activity, commonly used by malware for command and control (C2) communication, by analyzing DNS requests from source IP addresses to identify aggregate patterns indicative of DGA usage.
The Elastic Security team has developed a machine learning rule designed to detect potential Domain Generation Algorithm (DGA) activity, a common tactic employed by malware for dynamic command and control (C2) communication. Published on 2023/09/14 and updated on 2026/07/27, this detection leverages pre-built machine learning jobs within Elastic to analyze DNS requests from source IP addresses. It identifies aggregate patterns with a high probability of being DGA, enabling defenders to uncover sophisticated malware that frequently changes C2 domains to evade traditional signature-based detection. This capability is critical for organizations using Elastic Stack version 9.4.0 or higher, requiring the installation of the DGA Detection integration and DNS event collection via Elastic Defend, Network Packet Capture, or Packetbeat.
Impact
Successful DGA activity indicates an active malware infection attempting to establish or maintain persistent command and control (C2) communication. If left undetected, this allows attackers to remotely issue commands, exfiltrate sensitive data, deploy additional malicious payloads such as ransomware or wipers, or move laterally within the network. The dynamic nature of DGA domains makes these C2 channels resilient to simple domain blacklisting, significantly increasing the adversary's ability to sustain operations and escalate privileges, leading to severe data breaches, system compromise, and operational disruption.
Recommendation
- Install the Elastic DGA Detection integration assets, including the "Add preconfigured anomaly detection jobs," as described in the Elastic documentation for the
dgaintegration. - Ensure DNS events are being collected by Elastic Defend, Network Packet Capture, or Packetbeat and ingested into your Elastic environment.
- Enable the
dga_high_sum_probability_eamachine learning anomaly detection job within Kibana under the Machine Learning Jobs section. - Review alerts generated by the "Potential DGA Activity" rule, investigating the source IP address and flagged domains as outlined in the provided investigation guide.
- Isolate systems identified with DGA activity and block identified malicious domains at your network perimeter.