AWS GuardDuty DGA Domain Activity Detected
This rule detects when Amazon GuardDuty identifies an Amazon EC2 instance or a container querying algorithmically generated domains (DGA). DGA activity is often indicative of malware attempting to establish command and control (C2) communication with its operators. The rule specifically looks for GuardDuty findings with the product event type 'DGADomainRequest' and filters out sample findings.
YARA-L
