Elastic high stable kql

Machine Learning Detected DGA activity using a known SUNBURST DNS domain

A supervised machine learning model has identified a DNS question name that used by the SUNBURST malware and is predicted to be the result of a Domain Generation Algorithm.

View Source

Detection Logic

ml_is_dga.malicious_prediction:1 and dns.question.registered_domain:avsvmcloud.com

Field Validations

Loading…

Comments (0)

Loading comments...