Blog

No items found.

Machine vs machine: instant domain fluxing identification with Darktrace

Machine vs machine: instant domain fluxing identification with DarktraceDefault blog imageDefault blog image
02
Feb 2018
02
Feb 2018

The algorithms made famous by Conficker almost a decade ago are continuing to frustrate the security community.

A function of some advanced malware, Domain Generating Algorithms (DGA) rapidly generate new domains as a means of evading security personnel. This process is known as ‘domain fluxing’ and provides an alternative means of communication with the attacker’s command-and-control servers. They are very difficult to detect using a traditional security approach.

Darktrace’s AI and machine learning are designed to detect threats without any pre-existing knowledge of attacker targets, tools, or capabilities. While traditional security tools depend on specific Indicators of Compromise to identify malicious activity, Darktrace instead focuses on behavioral changes that may point to an active compromise. Detection of Domain Generating Algorithms is just one example of Darktrace’s ability to pinpoint attacker C2 communications through the identification of behavioral anomalies.

DGA identification in action

Darktrace recently saw an employee of a healthcare company connecting a personal laptop to the corporate network. The employee was asked by another member of the organization to troubleshoot the laptop as a favor. Unbeknown to the employee, and despite the fact that anti-virus was installed, the laptop was compromised by an unknown strain of malware.

On joining the network, the compromised laptop made DNS queries for domains that Darktrace classified as 100% rare for the environment. These domains appeared to be dynamically generated as they were all between 25 to 30 characters long and used multiple top-level domains. Darktrace immediately triggered a high-scoring domain fluxing alert due to the sudden increase in failed DNS requests for abnormal domains.

Additional domain fluxing alerts were triggered within 30 minutes of the device joining the network. The only reason that this highly suspicious activity was allowed to persist for that period of time was that the security administrator was at lunch.

A sample of Darktrace network logs showing failed DNS requests for DGA domains.

Event logs showing domain fluxing identification within 14 seconds of the device joining the network.

Rapid containment

The security administrator was informed of the situation on his return and immediately performed incident triage with Darktrace. The administrator was able to rapidly assess the device’s connection history using Darktrace’s native filters that are designed to detect scanning, lateral movement, C2 communications, and egress. He then identified the location of the compromised laptop, disabled its internet access, and physically removed the device from the network.

The total time from initial connection to identification, containment, and removal of the compromised, rogue device was approximately 67 minutes. The administrator left the following comment for the Darktrace analyst team:

Darktrace Threat Visualizer shows multiple domain fluxing model breaches as a result of a high volume of failed DNS requests for suspicious, dynamically-generated domains.

Closing thoughts

Darktrace’s AI approach focuses on identifying anomalies in evolving patterns of behavior. Although the laptop was new to the network, no other device was seen making a high volume of failed DNS requests for similar DGA domains. Darktrace immediately identified this activity as anomalous and generated an alert within 14 seconds of the device joining the network.

By employing Darktrace, a single analyst was able to discover and assess a compromised, rogue device operating within the network environment in just over an hour. What’s more, with Antigena (Darktrace’s autonomous response solution) in place, all suspicious behaviors would have been temporarily suspended, in real time. Alternatively, the administrator could have manually authorized Antigena’s proposed actions via the Darktrace Mobile App.

No extensive analysis of distributed log files, PCAPs, or other security tools. No prior knowledge of the attacker’s infrastructure or the malware. Darktrace AI identified DGA domains that were being produced on the fly, without help. That’s the level our security technology must perform at if we are to keep on top of all the new tech in the modern attacker’s toolkit.

More in this series:

No items found.

Like this and want more?

Receive the latest blog in your inbox
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.
INSIDE THE SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
AUTHOR
ABOUT ThE AUTHOR
Max Heinemeyer
Chief Product Officer

Max is a cyber security expert with over a decade of experience in the field, specializing in a wide range of areas such as Penetration Testing, Red-Teaming, SIEM and SOC consulting and hunting Advanced Persistent Threat (APT) groups. At Darktrace, Max oversees global threat hunting efforts, working with strategic customers to investigate and respond to cyber-threats. He works closely with the R&D team at Darktrace’s Cambridge UK headquarters, leading research into new AI innovations and their various defensive and offensive applications. Max’s insights are regularly featured in international media outlets such as the BBC, Forbes and WIRED. When living in Germany, he was an active member of the Chaos Computer Club. Max holds an MSc from the University of Duisburg-Essen and a BSc from the Cooperative State University Stuttgart in International Business Information Systems.

share this article
USE CASES
No items found.
PRODUCT SPOTLIGHT
No items found.
COre coverage
No items found.
This Article
Machine vs machine: instant domain fluxing identification with Darktrace
Share
Twitter logoLinkedIn logo

Related Articles

No items found.

Good news for your business.
Bad news for the bad guys.

Start your free trial

Start your free trial

Flexible delivery
You can either install it virtually or with hardware.
Fast install
Just 1 hour to set up – and even less for an email security trial.
Choose your journey
Try out Self-Learning AI wherever you most need it — including cloud, network or email.
No commitment
Full access to the Darktrace Threat Visualizer and three bespoke Threat Reports, with no obligation to purchase.
For more information, please see our Privacy Notice.
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.

Get a demo

Flexible delivery
You can either install it virtually or with hardware.
Fast install
Just 1 hour to set up – and even less for an email security trial.
Choose your journey
Try out Self-Learning AI wherever you most need it — including cloud, network or email.
No commitment
Full access to the Darktrace Threat Visualizer and three bespoke Threat Reports, with no obligation to purchase.
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.

Check out this article by Darktrace: Machine vs machine: instant domain fluxing identification with Darktrace