Skip to content
Threat Feed
Subscribe

Tag

Dga

2 briefs RSS
low advisory

Potential DGA Activity Detected by Machine Learning

A machine learning job detected potential DGA (domain generation algorithm) activity indicative of malware command and control (C2) channels, identifying source IP addresses making DNS requests with a high probability of being DGA-generated, a technique used by adversaries to evade detection.

dga command-and-control machine-learning
2r 2t
high threat

FIN7 DGA Command and Control Behavior Detection

This rule detects command and control activity associated with the FIN7 threat group, which is known to use domain generation algorithms (DGA) to maintain persistence in their target's network by identifying network traffic using TLS or HTTP protocols to domains with a specific pattern.

FIN7 +2 command-and-control dga network_traffic
3r 2t