Matheus Alves
@matheuswolfCompletionist
1 follower1 download0 copies0 likes26 views
1 detection
Filters
Last updated
All Time
Detection languages
1
Categories
1
1
Platforms
1
MITRE Techniques
1
1
This detection identifies potentially algorithmically generated domains (DGA) observed in Trend IA XDR telemetry. DGA domains are commonly used by malware families for Command and Control (C2) communications because they generate large numbers of pseudo-random domain names, making blocking and takedown efforts more difficult.
The detection focuses on domains that:
Have a moderate length (8-20 characters)
Contain numbers, which are common in many DGAs
Use frequently abused TLDs
Have low occurrence volume across the environment
Follow a simplified lexical pattern often associated with generated domains
The detection focuses on domains that:
Have a moderate length (8-20 characters)
Contain numbers, which are common in many DGAs
Use frequently abused TLDs
Have low occurrence volume across the environment
Follow a simplified lexical pattern often associated with generated domains
