DGA Domain Detection Based on Entropy and Numeric Patterns Trend AI
This detection identifies potentially algorithmically generated domains (DGA) observed in Trend IA XDR telemetry. DGA domains are commonly used by malware families for Command and Control (C2) communications because they generate large numbers of pseudo-random domain names, making blocking and takedown efforts more difficult. The detection focuses on domains that: Have a moderate length (8-20 characters) Contain numbers, which are common in many DGAs Use frequently abused TLDs Have low occurrence volume across the environment Follow a simplified lexical pattern often associated with generated domains
Sigma
