Elastic high stable kql
Machine Learning Detected DGA activity using a known SUNBURST DNS domain
A supervised machine learning model has identified a DNS question name that used by the SUNBURST malware and is predicted to be the result of a Domain Generation Algorithm.
Detection Logic
ml_is_dga.malicious_prediction:1 and dns.question.registered_domain:avsvmcloud.com Field Validations
Loading…
Comments (0)
Loading comments...