Infoblox High-Entropy DNS Query Names Indicating DGA

Siddhant Mishra@Siddhant

•updated yesterday•0•0•0

Detects algorithmically generated domain names at the resolver. Malware families using a DGA cycle through many candidate domains to find their live controller, so the resolver sees a burst of long, random-looking names, most of which fail to resolve. Resolver-level visibility covers every device that uses the resolver, including those with no endpoint agent — appliances, IoT and unmanaged hosts. Onboarding: INFOBLOX is ingested via Syslog (CEF) (Bloo extractor 155). Integration guide: https://bloo.io/docs/hypercloud/syslog-connector BQL (Bloo Query Language): stream=dns where sourcename='INFOBLOX' and action='DNS_QUERIED' and len(query) > 30 | groupby srcip, query, recordtype, responsecode