Skip to content
Threat Feed
Subscribe

Tag

Dga

4 briefs RSS
low advisory

Potential DGA Activity Detected by Elastic Machine Learning

An Elastic machine learning rule detects potential Domain Generation Algorithm (DGA) activity, commonly used by malware for command and control (C2) communication, by analyzing DNS requests from source IP addresses to identify aggregate patterns indicative of DGA usage.

dga command-and-control machine-learning dns elastic network-traffic
2t
high threat

Possible FIN7 DGA Command and Control Behavior

FIN7 threat group utilizes a specific Domain Generation Algorithm (DGA) for command and control (C2), characterized by domains with 4-5 alphabetic characters and specific top-level domains such as .pw, .us, .club, .info, .site, or .top, enabling persistence and continued operations within target networks.

FIN7 +2 command-and-control dga network-traffic persistence
1r 2t
low advisory

Potential DGA Activity Detected by Machine Learning

A machine learning job detected potential DGA (domain generation algorithm) activity indicative of malware command and control (C2) channels, identifying source IP addresses making DNS requests with a high probability of being DGA-generated, a technique used by adversaries to evade detection.

dga command-and-control machine-learning
2r 2t
high threat

FIN7 DGA Command and Control Behavior Detection

This rule detects command and control activity associated with the FIN7 threat group, which is known to use domain generation algorithms (DGA) to maintain persistence in their target's network by identifying network traffic using TLS or HTTP protocols to domains with a specific pattern.

FIN7 +2 command-and-control dga network_traffic
3r 2t