T1568.002: Dynamic Resolution: Domain Generation Algorithms (DGA) (Evading C2 blacklisting)
Operational Executive Summary
T1568.002 (Dynamic Resolution: Domain Generation Algorithms (DGA) (Evading C2 blacklisting)) is classified under the Command and Control tactic within the MITRE ATT&CK framework. Communication channels and covert protocols utilized to maintain interactive control of compromised implants through legitimate web protocols, encrypted proxies, and DNS tunneling. In telemetry gathered across enterprise endpoints and the EMBER 2018 benchmark, this technique was weaponized across 72 distinct malware families, totaling over 2,040 validated samples.
Technical Anatomy & Adversary Tradecraft
Adversaries leverage Dynamic Resolution: Domain Generation Algorithms (DGA) (Evading C2 blacklisting) to accomplish operational objectives while minimizing anomalous forensic footprints. When executing Dynamic Resolution: Domain Generation Algorithms (DGA) (Evading C2 blacklisting), malicious binaries commonly interact directly with low-level Windows APIs, kernel mode drivers, or native scripting interfaces to bypass traditional file-integrity monitors and static antivirus signatures.
In modern multi-stage campaigns, T1568.002 is frequently observed functioning as an intermediate bridge: initial access payloads (such as spearphishing loaders or exploit macros) execute Dynamic Resolution: Domain Generation Algorithms (DGA) (Evading C2 blacklisting) to establish in-memory execution or persistence before staging secondary ransomware or data-exfiltration implants.
Authoritative MITRE ATT&CK Reference: View official technique documentation, sub-techniques, and adversary groups at
https://attack.mitre.org/techniques/T1568/002/.
Detection Engineering & Threat Hunting
Detecting Dynamic Resolution: Domain Generation Algorithms (DGA) (Evading C2 blacklisting) requires telemetry correlation across endpoint detection and response (EDR) agents, Sysmon event streams, and security information event management (SIEM) pipelines:
- Process Creation & Lineage: Monitor parent-child process anomalies where unexpected parent binaries (e.g., Office executables, web browsers, or script hosts) spawn command shells or native Windows utilities.
- API Hooking & Behavioral Telemetry: EDR platforms should flag rapid calls to memory allocation, process injection, or registry manipulation APIs originating from unbacked executable memory regions.
- Network Anomaly Correlation: Cross-reference endpoint execution timestamps with external network socket establishment to identify anomalous beaconing or covert data staging.
SOC Containment & Hardening Guidance
To mitigate risks associated with T1568.002 (Dynamic Resolution: Domain Generation Algorithms (DGA) (Evading C2 blacklisting)) across production infrastructure, security teams should implement the following defensive controls:
- Attack Surface Reduction (ASR): Enforce strict application control policies (WDAC or AppLocker) to restrict execution to signed and verified corporate binaries.
- Least Privilege & Credential Hygiene: Restrict local administrative privileges to prevent adversaries from tampering with defensive agents or escalating privileges.
- Network Microsegmentation: Restrict lateral communication across endpoint VLANs to prevent wormable payloads from utilizing Dynamic Resolution: Domain Generation Algorithms (DGA) (Evading C2 blacklisting) across adjacent network segments.
Cataloged Malware Families Utilizing T1568.002 (72 Families)
The following malware families in the SystemHelpDesk catalog have been verified utilizing T1568.002 (Dynamic Resolution: Domain Generation Algorithms (DGA) (Evading C2 blacklisting)):
72 families
| Family | Category | Sample Count | Technical Summary |
|---|---|---|---|
| nymaim | Downloader | 756 | Nymaim is a sophisticated dual-stage malware downloader and loader first observed in 2013. Designed with extreme resilience, Nymaim specialized in evading secur... |
| khalesi | Infostealer | 555 | Backdoor:Win32/Khalesi is an evasive, modular information stealer and Remote Access Trojan (RAT) engineered to harvest corporate banking credentials, system con... |
| pykspa | Worm | 169 | Pykspa (cataloged across threat intelligence as W32/Pykspa, Worm:Win32/Pykspa, and the Skype Worm Pykspa) is an information-stealing worm that first emerged in ... |
| beebone | Worm | 151 | Beebone (widely cataloged across security vendors as the W32.Worm.Beebone or AAEH family) is a highly aggressive, polymorphic downloader worm first identified i... |
| phorpiex | Botnet | 115 | Phorpiex (also cataloged across the cybersecurity industry as Trik, Worm:Win32/Phorpiex, Trojan:Win32/Phorpiex, and Worm.Win32.Trik) is an infamous, multi-funct... |
| bancos | Banking Trojan | 55 | Bancos (cataloged across security vendors and threat intelligence databases under signatures including Trojan-Banker.Win32.Bancos, Trojan:Win32/Bancos, and Win3... |
| banbra | Banking Trojan | 53 | Banbra (cataloged across security vendors and threat intelligence databases under signatures including Trojan-Banker.Win32.Banbra, Trojan:Win32/Banbra, and Win3... |
| murofet | Trojan | 53 | Murofet (cataloged across security vendors and threat intelligence databases under detections including Trojan:Win32/Murofet, TrojanDownloader:Win32/Murofet, an... |
| shylock | Banking Trojan | 21 | Shylock (also cataloged across international law enforcement and intelligence communities as Capito) is a sophisticated financial malware family and banking tro... |
| conficker | Worm | 11 | Conficker (also known as Downadup or Kido) is one of the most prolific, destructive, and technologically advanced computer worms in internet history, first disc... |
| locky | Ransomware | 11 | Locky is one of the most prolific, damaging, and aggressively distributed ransomware strains in cyber history, first emerging in February 2016. Associated with ... |
| cryptolocker | Ransomware | 10 | CryptoLocker is the historic archetype of modern asymmetric ransomware, first discovered in September 2013. Engineered and operated under the criminal syndicate... |
| ramdo | Click Fraud | 8 | <h3>Executive Summary</h3> Ramdo (also known as Redyms) is a specialized Trojan and botnet client explicitly designed for click fraud and search engine manipula... |
| kido | Advanced Threat | 5 | Worm:Win32/Kido (universally known in the cybersecurity community as **Conficker**) is one of the most infamous, widespread, and devastating computer worms in h... |
| rovnix | Bootkit | 5 | Trojan:Win32/Rovnix is a highly sophisticated bootkit and trojan downloader designed to infect the Master Boot Record (MBR) or Volume Boot Record (VBR) to achie... |
| bedep | Ransomware | 3 | Bedep (classified in antivirus detection telemetry under designations including Ransom:Win32/Bedep, Ransom.Win32.Bedep, and Win32/Bedep) is a crypto-ransomware ... |
| crypt0l0cker | Ransomware | 2 | Ransomware:Win32/Crypt0l0cker is a highly destructive ransomware variant, often considered a direct clone or spiritual successor to the original, infamous Crypt... |
| napolar | Trojan | 2 | Trojan:Win32/Napolar (also widely tracked as Solarbot) is a highly sophisticated banking trojan and botnet client that gained prominence around 2013. It is desi... |
| necurs | Spam Bot | 2 | Botnet:Win32/Necurs was one of the largest, most pervasive botnet infrastructures in cybercrime history, comprising over 9 million compromised computers across ... |
| 0y0auaszpblb | Ransomware | 1 | 0Y0Auaszpblb (classified in antivirus detection telemetry under designations including Ransom:Win32/0Y0Auaszpblb, Ransom.Win32.0Y0Auaszpblb, and Win32/0Y0Auaszp... |
| 0y1a48lx2yib | Ransomware | 1 | 0Y1A48Lx2Yib (classified in antivirus detection telemetry under designations including Ransom:Win32/0Y1A48Lx2Yib, Ransom.Win32.0Y1A48Lx2Yib, and Win32/0Y1A48Lx2... |
| a8p9eklc | Trojan | 1 | A8P9Eklc (classified in antivirus detection telemetry under designations including Trojan:Win32/A8P9Eklc, Trojan.Win32.A8P9Eklc, and Win32/A8P9Eklc) is a multi-... |
| amgfvjgvdoaan | Ransomware | 1 | Amgfvjgvdoaan (classified in antivirus detection telemetry under designations including Ransom:Win32/Amgfvjgvdoaan, Ransom.Win32.Amgfvjgvdoaan, and Win32/Amgfvj... |
| be3auestydmi | Trojan | 1 | Be3Auestydmi (classified in antivirus detection telemetry under designations including Trojan:Win32/Be3Auestydmi, Trojan.Win32.Be3Auestydmi, and Win32/Be3Auesty... |
| bmkfxasqf6ki | Trojan | 1 | Bmkfxasqf6Ki (classified in antivirus detection telemetry under designations including Trojan:Win32/Bmkfxasqf6Ki, Trojan.Win32.Bmkfxasqf6Ki, and Win32/Bmkfxasqf... |
| bnuaaewgb2fb | Ransomware | 1 | Bnuaaewgb2Fb (classified in antivirus detection telemetry under designations including Ransom:Win32/Bnuaaewgb2Fb, Ransom.Win32.Bnuaaewgb2Fb, and Win32/Bnuaaewgb... |
| ciyaamgnrsg | Ransomware | 1 | Trojan:Win32/Ciyaamgnrsg (or similar auto-generated alphanumeric strings) represents the antivirus industry's response to highly polymorphic malware or Domain G... |
| ei0frdaui | Ransomware | 1 | Trojan:Win32/Ei0frdaui (or similar auto-generated strings) represents the antivirus industry's response to highly polymorphic malware or Domain Generation Algor... |
| emgfamt7gjgi | Trojan | 1 | <h3>Executive Summary</h3> "Emgfamt7gjgi" is a machine-generated detection signature utilized by advanced heuristic antivirus engines. It does not identify a sp... |
| emmfaeuirscb | Ransomware | 1 | Trojan:Win32/Emmfaeuirscb (or similar auto-generated strings) represents the antivirus industry's response to highly polymorphic malware or Domain Generation Al... |
| fnwabyxmbkm | Ransomware | 1 | Trojan:Win32/Fnwabyxmbkm (or similar auto-generated strings) represents the antivirus industry's response to highly polymorphic malware or Domain Generation Alg... |
| fz4aaueo2jhi | Ransomware | 1 | Trojan:Win32/Fz4aaueo2jhi (or similar auto-generated strings) represents the antivirus industry's response to highly polymorphic malware or Domain Generation Al... |
| hc4cakjs5bhi | Ransomware | 1 | Trojan:Win32/Hc4cakjs5bhi (or similar auto-generated strings) represents the antivirus industry's response to highly polymorphic malware or Domain Generation Al... |
| hmgfa45id4o | Trojan | 1 | <h3>Executive Summary</h3> "Hmgfa45id4o" is a generic, machine-generated detection signature utilized by advanced heuristic antivirus engines. It is not a named... |
| imqaaem1agai | Trojan | 1 | <h3>Executive Summary</h3> "Imqaaem1agai" is a machine-generated detection signature utilized by advanced heuristic antivirus engines. It does not identify a sp... |
| jnkfasgyvyo | Ransomware | 1 | Trojan:Win32/Jnkfasgyvyo (or similar auto-generated strings) represents the antivirus industry's response to highly polymorphic malware or Domain Generation Alg... |
| jo0br8hglsii | Ransomware | 1 | Trojan:Win32/Jo0br8hglsii (or similar auto-generated strings) represents the antivirus industry's response to highly polymorphic malware or Domain Generation Al... |
| kjwar5ju8ibgb | Trojan | 1 | <h3>Executive Summary</h3> "Kjwar5ju8ibgb" is a heuristic identifier for a highly obfuscated, generically detected Trojan or Dropper. The random, DGA-like (Doma... |
| kraken | Ransomware | 1 | <h3>Executive Summary</h3> Kraken is a notorious, highly sophisticated Botnet and Trojan malware family. At its peak in 2008, it was considered one of the large... |
| lmkfrhivlcfba | Trojan | 1 | <h3>Executive Summary</h3> "Lmkfrhivlcfba" is a machine-generated detection signature utilized by advanced heuristic antivirus engines. It does not identify a s... |
| lockyc | Ransomware | 1 | <h3>Executive Summary</h3> Lockyc (often detected as a direct variant or sophisticated copycat of the infamous Locky ransomware) is a highly destructive malware... |
| lurk | Ransomware | 1 | <h3>Executive Summary</h3> Lurk refers to both a highly sophisticated Trojan Downloader and the infamous Russian cybercriminal syndicate that created it. The Lu... |
| mmnfbgfpueki | Trojan | 1 | <h3>Executive Summary</h3> "Mmnfbgfpueki" is a heuristic identifier for a highly obfuscated, generically detected Trojan or Dropper. The random, DGA-like (Domai... |
| mmsfrmqm16ci | Ransomware | 1 | Trojan:Win32/Mmsfrmqm16ci (or similar auto-generated strings) represents the antivirus industry's response to highly polymorphic malware or Domain Generation Al... |
| mz0a4gxuisb | Trojan | 1 | <h3>Executive Summary</h3> "Mz0a4gxuisb" is a heuristic identifier for a highly obfuscated, generically detected Trojan or Dropper. The random, DGA-like (Domain... |
| niwaa8lfbrj | Ransomware | 1 | <h3>Executive Summary</h3> Niwaa8lfbrj is a heuristic detection name assigned to a highly obfuscated Trojan variant. The randomly generated alphanumeric name st... |
| nmkfxmdtnmoi | Trojan | 1 | <h3>Executive Summary</h3> "Nmkfxmdtnmoi" is a machine-generated detection signature utilized by advanced heuristic antivirus engines. It does not identify a sp... |
| omyaamfbexii | Ransomware | 1 | <h3>Executive Summary</h3> "Omyaamfbexii" is a generic detection identifier rather than a distinct, named malware family. It is typically generated automaticall... |
| onkfa0sahzhg | Ransomware | 1 | <h3>Executive Summary</h3> Onkfa0sahzhg is a heuristic detection name assigned to a highly obfuscated Trojan variant. The randomly generated alphanumeric name s... |
| pdxbbkgat9ci | Ransomware | 1 | <h3>Executive Summary</h3> Pdxbbkgat9ci is a heuristic detection name assigned to a highly obfuscated Trojan variant. The randomly generated alphanumeric name s... |
| pjzab0jsupjb | Trojan | 1 | <h3>Executive Summary</h3> "Pjzab0jsupjb" is a machine-generated detection signature utilized by advanced heuristic antivirus engines. It does not identify a sp... |
| qmlfrt0j91kid | Ransomware | 1 | Trojan:Win32/Qmlfrt0j91kid (or similar auto-generated strings) represents the antivirus industry's response to highly polymorphic malware or Domain Generation A... |
| qmuabwpoobbg | Ransomware | 1 | <h3>Executive Summary</h3> Qmuabwpoobbg is a heuristic detection name assigned to a highly obfuscated Trojan variant. The randomly generated alphanumeric name s... |
| rmkef9zs0zhi | Ransomware | 1 | Trojan:Win32/Rmkef9zs0zhi (or similar auto-generated strings) represents the antivirus industry's response to highly polymorphic malware or Domain Generation Al... |
| rmkefbclnjpi | Ransomware | 1 | Trojan:Win32/Rmkefbclnjpi (or similar auto-generated strings) represents the antivirus industry's response to highly polymorphic malware or Domain Generation Al... |
| rz0a4oaeuqdi | Ransomware | 1 | Trojan:Win32/Rz0a4oaeuqdi (or similar auto-generated strings) represents the antivirus industry's response to highly polymorphic malware or Domain Generation Al... |
| rz0auircb0di | Trojan | 1 | <h3>Executive Summary</h3> "Rz0auircb0di" is a heuristic identifier for a highly obfuscated, generically detected Trojan or Dropper. The random, DGA-like (Domai... |
| rzwaagpbkfii | Ransomware | 1 | Trojan:Win32/Rzwaagpbkfii (or similar auto-generated strings) represents the antivirus industry's response to highly polymorphic malware or Domain Generation Al... |
| sz4aaw | Trojan | 1 | <h3>Executive Summary</h3> "Sz4aaw" is a machine-generated detection signature utilized by advanced heuristic antivirus engines. It does not identify a specific... |
| uiwao0sam | Trojan | 1 | <h3>Executive Summary</h3> "Uiwao0sam" is a heuristic identifier for a highly obfuscated, generically detected Trojan or Dropper. The random, DGA-like (Domain G... |
| urcs | Ransomware | 1 | <h3>Executive Summary</h3> URCS (often associated with the URC Bot) is a sophisticated Remote Access Trojan (RAT) and Botnet framework engineered to provide att... |
| vesenlosow | Trojan | 1 | <h3>Executive Summary</h3> "Vesenlosow" is a machine-generated detection signature utilized by advanced heuristic antivirus engines. It does not identify a spec... |
| vz2au4dpceii | Ransomware | 1 | Trojan:Win32/Vz2au4dpceii (or similar auto-generated strings) represents the antivirus industry's response to highly polymorphic malware or Domain Generation Al... |
| wi0abyrjybki | Trojan | 1 | <h3>Executive Summary</h3> "Wi0abyrjybki" is a heuristic identifier for a highly obfuscated, generically detected Trojan or Dropper. The random, DGA-like (Domai... |
| wisbipuf | Trojan | 1 | <h3>Executive Summary</h3> "Wisbipuf" is a machine-generated detection signature utilized by advanced heuristic antivirus engines. It does not identify a specif... |
| xmgfa0ysjgki | Ransomware | 1 | Trojan:Win32/Xmgfa0ysjgki (or similar auto-generated strings) represents the antivirus industry's response to highly polymorphic malware or Domain Generation Al... |
| ymkfawdgfnmi | Trojan | 1 | <h3>Executive Summary</h3> "Ymkfawdgfnmi" is a machine-generated detection signature utilized by advanced heuristic antivirus engines. It does not identify a sp... |
| yy0aueeqipni | Ransomware | 1 | Trojan:Win32/Yy0aueeqipni (or similar auto-generated strings) represents the antivirus industry's response to highly polymorphic malware or Domain Generation Al... |
| yywaa08jovdg | Ransomware | 1 | Trojan:Win32/Yywaa08jovdg (or similar auto-generated strings) represents the antivirus industry's response to highly polymorphic malware or Domain Generation Al... |
| zaxar | Ransomware | 1 | <h3>Executive Summary</h3> Zaxar is a highly sophisticated Trojan and Botnet component that poses a severe threat to enterprise networks. While it functions as ... |
| zepto | Ransomware | 1 | <h3>Executive Summary</h3> Zepto is a highly destructive ransomware variant that gained massive notoriety in mid-2016. It is a direct evolution (and effectively... |
| zs0bbeypkrh | Ransomware | 1 | Trojan:Win32/Zs0bbeypkrh (or similar auto-generated strings) represents the antivirus industry's response to highly polymorphic malware or Domain Generation Alg... |