{"id":"T1568.002","name":"Domain Generation Algorithms","url":"https://attack.mitre.org/techniques/T1568/002","tactics":["command-and-control"],"platforms":["ESXi","Linux","macOS","Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0419","stix_id":"x-mitre-detection-strategy--263a0357-5f6d-4066-bfda-afeb883e51d7","name":"Detection Strategy for Dynamic Resolution using Domain Generation Algorithms.","url":"https://attack.mitre.org/detectionstrategies/DET0419","analytics":[{"id":"AN1178","stix_id":"x-mitre-analytic--ee7499f8-4262-47cf-8fff-5344f60bf2cf","name":"Analytic 1178","description":"Correlate DNS queries that generate domains with high entropy or gibberish patterns, combined with short-lived connections from unusual processes. Monitor Sysmon DNS events and Windows Security logs for abnormal query rates and failed lookups.","url":"https://attack.mitre.org/detectionstrategies/DET0419#AN1178","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Sysmon","channel":"EventCode=3, 22","data_component":"DC0082","data_component_name":"Network Connection Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Security","channel":"EventCode=4688","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-security"}],"mutable_elements":[{"field":"EntropyThreshold","description":"Set threshold for randomness in queried domain strings (e.g., >4.0)"},{"field":"QueryFailureRate","description":"Failed resolution ratio above normal baseline (e.g., >30%)"},{"field":"TimeWindow","description":"Duration for aggregating suspicious DNS queries (e.g., 5–10 min)"}],"live":true,"detection_strategies":["DET0419"],"techniques":["T1568.002"]},{"id":"AN1179","stix_id":"x-mitre-analytic--0faa41a3-0d4c-42d1-885a-12436fbee9c1","name":"Analytic 1179","description":"Identify processes issuing repeated DNS queries to random-looking domains with abnormal entropy or word concatenations. Correlate resolver logs with high NXDOMAIN rates and auditd socket connections.","url":"https://attack.mitre.org/detectionstrategies/DET0419#AN1179","platforms":["Linux"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"socket/connect","data_component":"DC0078","data_component_name":"Network Traffic Flow","log_source_slug":"auditd-syscall"},{"name":"linux:syslog","channel":"Multiple NXDOMAIN responses and high entropy domains","data_component":"DC0085","data_component_name":"Network Traffic Content","log_source_slug":"linux-syslog"}],"mutable_elements":[{"field":"NXDOMAINThreshold","description":"Ratio of failed queries triggering alert (e.g., >40%)"},{"field":"DomainAge","description":"Flag queries to domains registered in last 7–30 days"}],"live":true,"detection_strategies":["DET0419"],"techniques":["T1568.002"]},{"id":"AN1180","stix_id":"x-mitre-analytic--63de336c-105c-4e8f-aefc-420a3eac32e9","name":"Analytic 1180","description":"Monitor unified DNS logs for abnormal domain queries with low lexical similarity to known domains, repeated failed lookups, and random string structures. Cross-check with process logs to confirm unusual origins (non-browser apps).","url":"https://attack.mitre.org/detectionstrategies/DET0419#AN1180","platforms":["macOS"],"log_source_references":[{"name":"macos:unifiedlog","channel":"High entropy domain queries with multiple NXDOMAINs","data_component":"DC0078","data_component_name":"Network Traffic Flow","log_source_slug":"macos-unifiedlog"},{"name":"macos:unifiedlog","channel":"Unexpected apps performing repeated DNS lookups","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"macos-unifiedlog"}],"mutable_elements":[{"field":"ReputationFeedWhitelist","description":"Exclude trusted CDN and cloud provider domains"},{"field":"LexicalScoreThreshold","description":"Adjust score for word-based vs. letter-based DGAs"}],"live":true,"detection_strategies":["DET0419"],"techniques":["T1568.002"]},{"id":"AN1181","stix_id":"x-mitre-analytic--5a652a8f-a8e1-4010-bc2b-2ffaa2838333","name":"Analytic 1181","description":"Use ESXi syslogs to track abnormal DNS query patterns from management agents or VMs. Identify high-frequency, low-TTL, or unresolvable domains as suspicious. Correlate with unusual management plane process activity.","url":"https://attack.mitre.org/detectionstrategies/DET0419#AN1181","platforms":["ESXi"],"log_source_references":[{"name":"esxi:syslog","channel":"Frequent DNS queries with high entropy names or NXDOMAIN results","data_component":"DC0078","data_component_name":"Network Traffic Flow","log_source_slug":"esxi-syslog"}],"mutable_elements":[{"field":"ResolverConfigPaths","description":"Expected resolver settings for ESXi hosts"},{"field":"DomainWhitelist","description":"Trusted external domains for hypervisor operations"}],"live":true,"detection_strategies":["DET0419"],"techniques":["T1568.002"]}],"live":true,"version":"1.0","techniques":["T1568.002"]}],"sigma_rules":[{"id":"19bf6fdb-7721-4f3d-867f-53467f6a5db6","title":"Communication To Ngrok Tunneling Service - Linux","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2022-11-03","modified":null,"description":"Detects an executable accessing an ngrok tunneling endpoint, which could be a sign of forbidden exfiltration of data exfiltration by malicious actors","references":["https://twitter.com/hakluke/status/1587733971814977537/photo/1","https://ngrok.com/docs/secure-tunnels/tunnels/ssh-reverse-tunnel-agent"],"logsource":{"product":"linux","category":"network_connection"},"tags":["attack.exfiltration","attack.command-and-control","attack.t1567","attack.t1568.002","attack.t1572","attack.t1090","attack.t1102","attack.s0508"],"path":"rules/linux/network_connection/net_connection_lnx_ngrok_tunnel.yml","techniques":["T1567","T1568.002","T1572","T1090","T1102"],"cves":[]},{"id":"1d08ac94-400d-4469-a82f-daee9a908849","title":"Communication To Ngrok Tunneling Service Initiated","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2022-11-03","modified":"2024-02-02","description":"Detects an executable initiating a network connection to \"ngrok\" tunneling domains.\nAttackers were seen using this \"ngrok\" in order to store their second stage payloads and malware.\nWhile communication with such domains can be legitimate, often times is a sign of either data exfiltration by malicious actors or additional download.\n","references":["https://twitter.com/hakluke/status/1587733971814977537/photo/1","https://ngrok.com/docs/secure-tunnels/tunnels/ssh-reverse-tunnel-agent"],"logsource":{"product":"windows","category":"network_connection"},"tags":["attack.exfiltration","attack.command-and-control","attack.t1567","attack.t1568.002","attack.t1572","attack.t1090","attack.t1102","attack.s0508"],"path":"rules/windows/network_connection/net_connection_win_domain_ngrok_tunnel.yml","techniques":["T1567","T1568.002","T1572","T1090","T1102"],"cves":[]}],"kev_cves":[],"_built":"2026-08-24 19:45 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}