Domain generation algorithm (DGA)

The Conficker worm, first seen in November 2008, computed 250 candidate domain names a day to reach its command servers. Variant C, set to activate on April 1, 2009, jumped to 50,000 domains a day, of which it contacted 500, and the Conficker Working Group had to coordinate with registries to block those names in advance. A domain generation algorithm (DGA, technique T1568.002 in MITRE ATT&CK) is that deterministic, often secret function built into malware that produces hundreds or thousands of names from a seed, typically the current date. The attacker registers just one; the malware tries them in turn until one answers. Taking down the command-and-control infrastructure by seizing domains becomes close to impossible. DGA variants have since turned up in dozens of malware families. The countermeasure is prediction: if the algorithm is known or recovered through reverse engineering, defenders compute the list of future domains ahead of time and block them, or register them themselves to watch infected machines check in (sinkholing). On the detection side, DNS traffic analysis in the SIEM flags queries to high-entropy names never seen before and often unresolved. Recognizing a DGA family also helps threat intelligence tie an incident to a known tool, and sometimes to the group that uses it.