t1568-002-domain-generation-algorithms

name	T1568.002_domain-generation-algorithms
description	Adversaries may make use of Domain Generation Algorithms (DGAs) to dynamically identify a destination domain for command and control traffic rather than relying on a list of static IP addresses or ...
category	configuration
version	18.1
author	cyberstrike-official
tags	["mitre-attack","enterprise","t1568.002","command-and-control","linux","macos","windows","esxi","sub-technique"]
technique_id	T1568.002
tactic	command-and-control
all_tactics	["command-and-control"]
platforms	["Linux","macOS","Windows","ESXi"]
mitre_url	https://attack.mitre.org/techniques/T1568/002
tech_stack	["linux","macos","windows","esxi"]
cwe_ids	["CWE-300"]
chains_with	["T1568","T1568.001","T1568.003"]
prerequisites	["T1568"]
severity_boost	{"T1568":"Chain with T1568 for deeper attack path","T1568.001":"Chain with T1568.001 for deeper attack path","T1568.003":"Chain with T1568.003 for deeper attack path"}

T1568.002 Domain Generation Algorithms

Sub-technique of: T1568

High-Level Description

Adversaries may make use of Domain Generation Algorithms (DGAs) to dynamically identify a destination domain for command and control traffic rather than relying on a list of static IP addresses or domains. This has the advantage of making it much harder for defenders to block, track, or take over the command and control channel, as there potentially could be thousands of domains that malware can check for instructions.

DGAs can take the form of apparently random or “gibberish” strings (ex: istgmxdejdnxuyla.ru) when they construct domain names by generating each letter. Alternatively, some DGAs employ whole words as the unit by concatenating words together instead of letters (ex: cityjulydish.net). Many DGAs are time-based, generating a different domain for each time period (hourly, daily, monthly, etc). Others incorporate a seed value as well to make predicting future domains more difficult for defenders.

Adversaries may use DGAs for the purpose of Fallback Channels. When contact is lost with the primary command and control server malware may employ a DGA as a means to reestablishing command and control.

Kill Chain Phase

• Command and Control (TA0011)

Platforms: Linux, macOS, Windows, ESXi

What to Check

• Identify if Domain Generation Algorithms technique is applicable to target environment
• Check Linux systems for indicators of Domain Generation Algorithms
• Check macOS systems for indicators of Domain Generation Algorithms
• Check Windows systems for indicators of Domain Generation Algorithms
• Verify mitigations are bypassed or absent (2 known mitigations)
• Assess detection coverage (1 detection strategies)

How to Test

Manual Testing

1. Identify Attack Surface: Determine if the target environment is susceptible to Domain Generation Algorithms by examining the target platforms (Linux, macOS, Windows).

2. Assess Existing Defenses: Review whether mitigations for T1568.002 are in place. If defenses are absent or misconfigured, this technique may be exploitable.

3. Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.