Elastic low stable eql

Potential DGA Activity

A population analysis machine learning job detected potential DGA (domain generation algorithm) activity. Such activity is often used by malware command and control (C2) channels. This machine learning job looks for a source IP address making DNS requests that have an aggregate high probability of being DGA activity.

View Source

Detection Logic

Field Validations

Loading…

Comments (0)

Loading comments...