tfMITRE ATT&CK sub-technique

Domain Generation Algorithms T1568.002

sub-technique of T1568 Dynamic Resolution

Tactic: Command and Control
Platforms: ESXi, Linux, macOS, Windows
Version: 1.2
Created: 10 March 2020
Last modified: 12 May 2026
Contributors: Ryan Benson, Exabeam; Barry Shteiman, Exabeam; Sylvain Gil, Exabeam

Adversaries may make use of Domain Generation Algorithms (DGAs) to dynamically identify a destination domain for command and control traffic rather than relying on a list of static IP addresses or domains. This has the advantage of making it much harder for defenders to block, track, or take over the command and control channel, as there potentially could be thousands of domains that malware can check for instructions.[1][2][3]

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups56th pct

Threat groups56th percentile · 56% of ATT&CK techniques have this many threat groups attributed or fewer.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malwareTop 16%

Tools & malware84th percentile · 84% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rules50th pct

Detection rules50th percentile · 50% of ATT&CK techniques have more detection rules written.

Domain Generation Algorithms MITRE reference T1568.002

56th pctamong all ATT&CK techniques for number of groups

2 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

TA551G0127 ↗

Has used a DGA to generate URLs from executed macros.1 2

created 2021-03-192 referencesaka GOLD CABIN

APT41G0096 ↗

Has used DGAs to change their C2 servers monthly.1

created 2019-09-231 referenceaka Wicked Panda

All 2 groups for this technique

Offense vs defense T1568.002

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 0Sigma rules (cumulative) · 2Splunk ESCU (cumulative) · 0

first rule: 2022 Q4

Domain Generation Algorithms detection strategy DET0419

MITRE names one behaviour worth catching for this technique and breaks it into 4 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection Strategy for Dynamic Resolution using Domain Generation Algorithms.

Enterprise

4 platforms

AN1178 · Windows

Correlate DNS queries that generate domains with high entropy or gibberish patterns, combined with short-lived connections from unusual processes. Monitor Sysmon DNS events and Windows Security logs for abnormal query rates and failed lookups.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Security	EventCode=4688
Network Connection CreationDC0082	WinEventLog:Sysmon	EventCode=3, 22

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
EntropyThreshold	Set threshold for randomness in queried domain strings (e.g., >4.0)
QueryFailureRate	Failed resolution ratio above normal baseline (e.g., >30%)
TimeWindow	Duration for aggregating suspicious DNS queries (e.g., 5–10 min)

AN1179 · Linux

Identify processes issuing repeated DNS queries to random-looking domains with abnormal entropy or word concatenations. Correlate resolver logs with high NXDOMAIN rates and auditd socket connections.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Network Traffic FlowDC0078	auditd:SYSCALL	socket/connect
Network Traffic ContentDC0085	linux:syslog	Multiple NXDOMAIN responses and high entropy domains

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
NXDOMAINThreshold	Ratio of failed queries triggering alert (e.g., >40%)
DomainAge	Flag queries to domains registered in last 7–30 days

AN1180 · macOS

Monitor unified DNS logs for abnormal domain queries with low lexical similarity to known domains, repeated failed lookups, and random string structures. Cross-check with process logs to confirm unusual origins (non-browser apps).

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	macos:unifiedlog	Unexpected apps performing repeated DNS lookups
Network Traffic FlowDC0078	macos:unifiedlog	High entropy domain queries with multiple NXDOMAINs

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ReputationFeedWhitelist	Exclude trusted CDN and cloud provider domains
LexicalScoreThreshold	Adjust score for word-based vs. letter-based DGAs

AN1181 · ESXi

Use ESXi syslogs to track abnormal DNS query patterns from management agents or VMs. Identify high-frequency, low-TTL, or unresolvable domains as suspicious. Correlate with unusual management plane process activity.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Network Traffic FlowDC0078	esxi:syslog	Frequent DNS queries with high entropy names or NXDOMAIN results

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ResolverConfigPaths	Expected resolver settings for ESXi hosts
DomainWhitelist	Trusted external domains for hypervisor operations

Tests1Executorsbash 1Need elevation0 of 1Have prerequisites1Have cleanup0Platformslinux

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

DGA Simulation (Python)

linux

bash

—

Simulates Domain Generation Algorithm (DGA) traffic by generating pseudo-random domains based on the current date and querying them using dig. This is designed to trigger DNS analytics and NGIDS.

Input arguments

Name	Type	Default	Description
python_script_path	string	PathToAtomicsFolder/T1568.002/src/T1568.002.py	Full path to the DGA python script

Attack command

python3 "#{python_script_path}"

Prerequisite

#{python_script_path} must exist on system.

Check

if [ -f "#{python_script_path}" ]; then exit 0; else exit 1; fi

Satisfy

mkdir -p "$(dirname "#{python_script_path}")"
curl -sL "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1568.002/src/T1568.002.py" -o "#{python_script_path}"

Prerequisite

Python 3 must be installed to run the script.

Check

which python3

Satisfy

sudo apt-get update && sudo apt-get install -y python3

GUID12fda26c-070b-44fd-8fe8-5f695a10b991

Tests from Atomic Red Team (MIT licence) · technique definition

Domain Generation Algorithms detections T1568.002

2 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

50th pctamong all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs