Adversaries may make use of Domain Generation Algorithms (DGAs) to dynamically identify a destination domain for command and control traffic rather than relying on a list of static IP addresses or domains. This has the advantage of making it much harder for defenders to block, track, or take over the command and control channel, as there potentially could be thousands of domains that malware can check for instructions.(Citation: Cybereason Dissecting DGAs)(Citation: Cisco Umbrella DGA)(Citation: Unit 42 DGA Feb 2019)

DGAs can take the form of apparently random or “gibberish” strings (ex: istgmxdejdnxuyla.ru) when they construct domain names by generating each letter. Alternatively, some DGAs employ whole words as the unit by concatenating words together instead of letters (ex: cityjulydish.net). Many DGAs are time-based, generating a different domain for each time period (hourly, daily, monthly, etc). Others incorporate a seed value as well to make predicting future domains more difficult for defenders.(Citation: Cybereason Dissecting DGAs)(Citation: Cisco Umbrella DGA)(Citation: Talos CCleanup 2017)(Citation: Akamai DGA Mitigation)

Adversaries may use DGAs for the purpose of [Fallback Channels](https://attack.mitre.org/techniques/T1008). When contact is lost with the primary command and control server malware may employ a DGA as a means to reestablishing command and control.(Citation: Talos CCleanup 2017)(Citation: FireEye POSHSPY April 2017)(Citation: ESET Sednit 2017 Activity)
Domain Generation Algorithms
source_name: mitre-attack  url: https://attack.mitre.org/techniques/T1568/002  external_id: T1568.002     source_name: Cybereason Dissecting DGAs  description: Sternfeld, U. (2016). Dissecting Domain Generation Algorithms: Eight Real World DGA Variants. Retrieved February 18, 2019.  url: http://go.cybereason.com/rs/996-YZT-709/images/Cybereason-Lab-Analysis-Dissecting-DGAs-Eight-Real-World-DGA-Variants.pdf     source_name: Cisco Umbrella DGA  description: Scarfo, A. (2016, October 10). Domain Generation Algorithms – Why so effective?. Retrieved February 18, 2019.  url: https://umbrella.cisco.com/blog/2016/10/10/domain-generation-algorithms-effective/     source_name: Unit 42 DGA Feb 2019  description: Unit 42. (2019, February 7). Threat Brief: Understanding Domain Generation Algorithms (DGA). Retrieved February 19, 2019.  url: https://unit42.paloaltonetworks.com/threat-brief-understanding-domain-generation-algorithms-dga/     source_name: Talos CCleanup 2017  description: Brumaghin, E. et al. (2017, September 18). CCleanup: A Vast Number of Machines at Risk. Retrieved March 9, 2018.  url: http://blog.talosintelligence.com/2017/09/avast-distributes-malware.html     source_name: Akamai DGA Mitigation  description: Liu, H. and Yuzifovich, Y. (2018, January 9). A Death Match of Domain Generation Algorithms. Retrieved February 18, 2019.  url: https://blogs.akamai.com/2018/01/a-death-match-of-domain-generation-algorithms.html     source_name: FireEye POSHSPY April 2017  description: Dunwoody, M.. (2017, April 3). Dissecting One of APT29’s Fileless WMI and PowerShell Backdoors (POSHSPY). Retrieved April 5, 2017.  url: https://www.fireeye.com/blog/threat-research/2017/03/dissecting_one_ofap.html     source_name: ESET Sednit 2017 Activity  description: ESET. (2017, December 21). Sednit update: How Fancy Bear Spent the Year. Retrieved February 18, 2019.  url: https://www.welivesecurity.com/2017/12/21/sednit-update-fancy-bear-spent-year/     source_name: Data Driven Security DGA  description: Jacobs, J. (2014, October 2). Building a DGA Classifier: Part 2, Feature Engineering. Retrieved February 18, 2019.  url: https://datadrivensecurity.info/blog/posts/2014/Oct/dga-part2/     source_name: Pace University Detecting DGA May 2017  description: Chen, L., Wang, T.. (2017, May 5). Detecting Algorithmically Generated Domains Using Data Visualization and N-Grams Methods . Retrieved April 26, 2019.  url: http://csis.pace.edu/~ctappert/srd2017/2017PDF/d4.pdf     source_name: Elastic Predicting DGA  description: Ahuja, A., Anderson, H., Grant, D., Woodbridge, J.. (2016, November 2). Predicting Domain Generation Algorithms with Long Short-Term Memory Networks. Retrieved April 26, 2019.  url: https://arxiv.org/pdf/1611.00791.pdf     