Use Case: Domain Generation Algorithm Detection

Machine Learning Detected a DNS Request Predicted to be a DGA Domain

Apr 1, 2026 · Domain: Network Domain: Endpoint Data Source: Elastic Defend Use Case: Domain Generation Algorithm Detection Rule Type: ML Rule Type: Machine Learning Tactic: Command and Control Resources: Investigation Guide ·

Share on:

A supervised machine learning model has identified a DNS question name that is predicted to be the result of a Domain Generation Algorithm (DGA), which could indicate command and control network activity.

Machine Learning Detected a DNS Request With a High DGA Probability Score

Apr 1, 2026 · Domain: Network Domain: Endpoint Data Source: Elastic Defend Use Case: Domain Generation Algorithm Detection Rule Type: ML Rule Type: Machine Learning Tactic: Command and Control Resources: Investigation Guide ·

Share on:

A supervised machine learning model has identified a DNS question name with a high probability of sourcing from a Domain Generation Algorithm (DGA), which could indicate command and control network activity.

Machine Learning Detected DGA activity using a known SUNBURST DNS domain

Apr 1, 2026 · Domain: Network Domain: Endpoint Data Source: Elastic Defend Use Case: Domain Generation Algorithm Detection Rule Type: ML Rule Type: Machine Learning Tactic: Command and Control Resources: Investigation Guide ·

Share on:

A supervised machine learning model has identified a DNS question name that used by the SUNBURST malware and is predicted to be the result of a Domain Generation Algorithm.

Potential DGA Activity

Apr 1, 2026 · Use Case: Domain Generation Algorithm Detection Rule Type: ML Rule Type: Machine Learning Tactic: Command and Control Resources: Investigation Guide ·

Share on:

A population analysis machine learning job detected potential DGA (domain generation algorithm) activity. Such activity is often used by malware command and control (C2) channels. This machine learning job looks for a source IP address making DNS requests that have an aggregate high probability of being DGA activity.