Threat Hunting Exercise: Analyzing DNS DGA (Domain Generation Algorithm) Beaconing Dataset

This hunt uses a simulated internal DNS resolver dataset (dns_dga_beacon_2022-07-16T093000.json) capturing T1568.002: Domain Generation Algorithms, where malware on an infected host queries a rapid succession of algorithmically-generated, pseudo-random domain names in search of a live C2 rendezvous point, the majority of which resolve to NXDOMAIN.

Step 1: Hypothesis Formation

Hypothesis: A host generates DNS queries for a high volume of syntactically random-looking domain names (high entropy, consonant-heavy, no dictionary-word structure) in a short window, the large majority of which return NXDOMAIN, with one or a few eventually resolving to an external IP - consistent with a DGA cycling through candidate domains until it finds its currently-active C2 host. Indicators:

DNS query logs: dozens to hundreds of distinct queries from one host in a short window, high Shannon entropy on the domain label, consistent length/character-set pattern (suggesting algorithmic generation, not human typing or organic browsing).
NXDOMAIN response rate for these queries >> host's normal NXDOMAIN rate.
Successful resolutions (the rare non-NXDOMAIN hits) point to newly-registered or reputation-unknown IPs.
Query pattern repeats on a predictable schedule (e.g., daily at a fixed hour) - many DGAs seed on the current date.

Null Hypothesis: A misconfigured or legitimate application is generating malformed/randomized DNS lookups (e.g., a broken CDN client, a security research tool, or a browser prefetch feature gone wrong). Invalidate by checking the querying process on the host and confirming no known legitimate software matches this query volume/pattern.

Rationale: DGA-based C2 is designed specifically to defeat static domain blocklisting; this hunt validates statistical/entropy-based DNS analysis as a detection method that doesn't depend on any single domain being previously known-bad.

Step 2: Data Sources and Scope

Sources: Internal DNS resolver query logs (with response codes); EDR process-to-DNS-query correlation (if available); Passive DNS/reputation enrichment for successfully-resolved domains.
Scope: ~2022-07-16T09:30:00-09:45:00 UTC; Host: WKS-OPS-018 (10.130.5.22).
SIEM Queries (Splunk/ELK):
High-volume distinct queries: index=dns src_ip="10.130.5.22" | stats dc(query) as distinct_domains by src_ip, bucket(_time, 15m) | where distinct_domains > 50
Entropy scoring: index=dns src_ip="10.130.5.22" | eval entropy=shannon_entropy(query_label) | where entropy > 3.5
NXDOMAIN ratio: index=dns src_ip="10.130.5.22" | stats count(eval(rcode="NXDOMAIN")) as nx, count as total | eval ratio=nx/total

Step 3: Key Findings

Parsed events (6 shown) confirm 214 high-entropy DNS queries in a 15-minute window, 96% NXDOMAIN, with one successful resolution to a low-reputation IP.

Timestamp (UTC)	Host	Query	Response	IOC/Why Suspicious?
2022-07-16 09:30:04	WKS-OPS-018	xqpzrltvbn.com	NXDOMAIN	Entropy IOC: 10-character consonant-heavy string, Shannon entropy 3.9 - well above the ~3.0 typical of organic domain names.
2022-07-16 09:30:05	WKS-OPS-018	mjvkdolwqa.com	NXDOMAIN	Second query, 1 second later, same length/character-set pattern - consistent with algorithmic generation, not manual typing.
2022-07-16 09:30:06 - 09:44:50	WKS-OPS-018	(212 additional similarly-structured domains)	205 NXDOMAIN, 1 success	Volume IOC: 214 distinct domains queried by one host in 15 minutes - no legitimate browsing or application behavior resembles this.
2022-07-16 09:41:12	WKS-OPS-018	ftbnxqrpla.net	Resolved to 194.61.55.28	Rendezvous IOC: the one successful resolution among 214 attempts - this is the DGA "finding" its live C2 host for the day.
-	-	(reputation check)	194.61.55.28: registered 4 days prior, hosting provider flagged for prior malware C2 in threat-intel feeds	Corroborates the successfully-resolved IP as malicious infrastructure, not a false-positive resolution.
-	WKS-OPS-018	(process check via EDR)	`svchost.exe` (non-standard parent) is the querying process	Process-anomaly IOC: legitimate `svchost.exe` service hosting does not generate DNS query bursts of this volume/pattern - indicates process injection into a trusted binary name.

Validation:

Timeline: 214 queries in a 15-minute burst, 96% NXDOMAIN, one live resolution - a textbook DGA cycling pattern.
False Positives: No legitimate software on the host's inventory matches this query volume; the querying process itself shows signs of injection (svchost.exe with an atypical parent), ruling out benign misconfiguration.
Correlation: Single host, single time window, statistically extreme entropy and NXDOMAIN ratio - very high confidence DGA activity.

Step 4: Recommendations & Next Steps

Immediate Response: Isolate WKS-OPS-018; block 194.61.55.28 at the perimeter/DNS sinkhole; capture memory to identify the injected process and extract the DGA seed/algorithm if possible (useful for predicting and pre-blocking future domains); scope for lateral spread.
Detection: Sigma-style rule: title: High-Volume High-Entropy DNS Queries with Elevated NXDOMAIN Rate → selection: distinct_domains_15m > 50 AND avg_entropy > 3.5 AND nxdomain_ratio > 0.85 - this is a durable, domain-agnostic detection that doesn't require any specific DGA family's IOCs.
Pro Tip: DGA detection is one of the best examples of statistical/behavioral hunting outperforming IOC-based blocking - invest in entropy and n-gram scoring on your DNS resolver logs even without any specific threat-intel feed, since it generalizes across DGA families and campaigns.

Hypothesis confirmed - a DGA-driven malware infection generated 214 high-entropy DNS queries in 15 minutes, successfully resolving one live C2 rendezvous domain!