Lion Cipher Lab
Spot a domain generation algorithm: the DNS pattern that reveals resilient C2
- Digital Forensics & IR (DFIR)
- Advanced
- ~50 min
- Free · no account required
Why it matters
When you block a malware's command-and-control (C2) domain, a good adversary shrugs — because their malware never depended on that one name. A Domain Generation Algorithm (DGA) has the malware and the operator independently compute the SAME giant list of throwaway domains each day from a shared seed; the malware tries them until one answers, and the operator only has to register a single domain per period to stay reachable. You cannot block your way out of that with a list. But the technique leaves a loud fingerprint in DNS logs: a single host firing hundreds of random-looking domain lookups…
What you'll learn
- reading a DNS resolver log to characterise malware command-and-control (C2)
- recognising a Domain Generation Algorithm (DGA) by its fingerprint
- scoring a domain's character entropy by eye (no dictionary words, uniform length, random-looking labels)
- using the NXDOMAIN (non-existent-domain) failure ratio as the primary DGA signal
- inferring the seed-plus-date relationship that rotates the domain set daily
- explaining why DGA makes C2 resilient to simple domain blocking
- mapping the behaviour to MITRE ATT&CK T1568.002
- judgment: when DNS-pattern analysis catches a DGA and when a smarter DGA evades it
Steps in this lab
- The scenario, and what a DGA actually is
- The DNS log — read it before you read another word of mine
- Tell #1 — the domains don't look like language
- Tell #2 — the NXDOMAIN flood is the real signature
- Tell #3 — the set rotates by date (seed + date)
- Say it out loud — the analyst's one-paragraph verdict
- The third rule — WHEN this reading works, WHEN it fails, and HOW a pro does it at scale
- Why DGA makes C2 resilient — the takeaway to keep