Techniques › T1568 › T1568.002
T1568.002 Domain Generation Algorithms
command and control — ESXi, Linux, macOS, Windows · attack.mitre.org · JSON
1
MITRE detection strategy
4
analytics
2
Sigma rules tagged attack.t1568.002
0
KEV CVEs mapped here
<p>Adversaries may make use of Domain Generation Algorithms (DGAs) to dynamically identify a destination domain for command and control traffic rather than relying on a list of static IP addresses or domains. This has the advantage of making it much harder for defenders to block, track, or take over the command and control channel, as there potentially could be thousands of domains that malware can check for instructions.</p><p>DGAs can take the form of apparently random or “gibberish” strings (ex: istgmxdejdnxuyla.ru) when they construct domain names by generating each letter. Alternatively, some DGAs employ whole words as the unit by concatenating words together instead of letters (ex: cityjulydish.net). Many DGAs are time-based, generating a different domain for each time period (hourly, daily, monthly, etc). Others incorporate a seed value as well to make predicting future domains more difficult for defenders.</p><p>Adversaries may use DGAs for the purpose of Fallback Channels. When contact is lost with the primary command and control server malware may employ a DGA as a means to reestablishing command and control.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0419 Detection Strategy for Dynamic Resolution using Domain Generation Algorithms. v1.0
AN1178 WindowsCorrelate DNS queries that generate domains with high entropy or gibberish patterns, combined with short-lived connections from unusual processes. Monitor Sysmon DNS events and Windows Security logs for abnormal query rates and failed lookups.Tunable:
EntropyThresholdQueryFailureRateTimeWindowAN1179 LinuxIdentify processes issuing repeated DNS queries to random-looking domains with abnormal entropy or word concatenations. Correlate resolver logs with high NXDOMAIN rates and auditd socket connections.Tunable:NXDOMAINThresholdDomainAgeAN1180 macOSMonitor unified DNS logs for abnormal domain queries with low lexical similarity to known domains, repeated failed lookups, and random string structures. Cross-check with process logs to confirm unusual origins (non-browser apps).Tunable:ReputationFeedWhitelistLexicalScoreThresholdAN1181 ESXiUse ESXi syslogs to track abnormal DNS query patterns from management agents or VMs. Identify high-frequency, low-TTL, or unresolvable domains as suspicious. Correlate with unusual management plane process activity.esxi:syslogFrequent DNS queries with high entropy names or NXDOMAIN results→ DC0078 Network Traffic FlowTunable:ResolverConfigPathsDomainWhitelist
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1568.002
Author: Florian Roth (Nextron Systems)
· 2022-11-03 · logsource: product=linux category=network_connection · 19bf6fdb-7721-4f3d-867f-53467f6a5db6
Detects an executable accessing an ngrok tunneling endpoint, which could be a sign of forbidden exfiltration of data exfiltration by malicious actors
Author: Florian Roth (Nextron Systems)
· 2022-11-03 (modified 2024-02-02) · logsource: product=windows category=network_connection · 1d08ac94-400d-4469-a82f-daee9a908849
Detects an executable initiating a network connection to "ngrok" tunneling domains.
Attackers were seen using this "ngrok" in order to store their second stage payloads and malware.
While communication with such domains can be legitimate, often times is a sign of either data exfiltration by malicious actors or additional download.
Rules tagged at the parent level (attack.t1568) 2
These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.
Author: Florian Roth (Nextron Systems)
· 2017-11-08 (modified 2023-05-18) · logsource: category=proxy · 195c1119-ef07-4909-bb12-e66f5e07bf3c
Detects download of certain file types from hosts with dynamic DNS names (selected list)
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2026-04-01 · logsource: category=dns · 73e5d24f-493f-4092-bd2f-c72cabda40ee
Detects DNS queries for the malicious C2 domain associated with the plain-crypto-js/Axios npm package supply chain compromise.
On March 30, 2026, malicious versions (1.14.1, 0.30.4) were published to npm, injecting a dependency (plain-crypto-js@4.2.1) that executed a postinstall script as a cross-platform RAT dropper.
This detection detects endpoints attempting to resolve the attacker's C2 domain (sfrclak.com) used for command and control communication.