// MITRE ATT&CK
T1568.002 · Domain Generation Algorithms
Sub-technique of T1568 · Dynamic Resolution.
Adversaries may make use of Domain Generation Algorithms (DGAs) to dynamically identify a destination domain for command and control traffic rather than relying on a list of static IP addresses or domains. This has the advantage of making it much harder for defenders to block, track, or take over th...
How to detect & mitigate it
Detecting Domain Generation Algorithms starts with your SIEM/EDR telemetry. Write a detection rule with the Sigma generator, analyze suspicious logs in the log analyzer, and place the technique on your coverage with the ATT&CK matrix.
Related techniques
T1132.001
Standard Encoding T1071.004
DNS T1071.005
Publish/Subscribe Protocols T1573.001
Symmetric Cryptography T1568.001
Fast Flux DNS T1071
Application Layer Protocol T1219
Remote Access Tools T1572
Protocol Tunneling
Standard Encoding T1071.004
DNS T1071.005
Publish/Subscribe Protocols T1573.001
Symmetric Cryptography T1568.001
Fast Flux DNS T1071
Application Layer Protocol T1219
Remote Access Tools T1572
Protocol Tunneling
Source: MITRE ATT&CK®. ATT&CK is a registered trademark of The MITRE Corporation. Content for educational purposes.