Lab 12 · detection engineering · extends Lab 4

The domains that don't exist yet.

Lab 4 caught the DNS tunnel. This is the other half of the DNS fight: how C2 stays reachable when defenders block domains and seize IPs. Two moves — a domain-generation algorithm that mints thousands of throwaway names so a blocklist can never keep up, and fast-flux that rotates the IPs behind one name across a swarm of hosts. You can't enumerate what hasn't been registered — but you don't have to. The names look wrong, and the resolution behaves wrong, and both are measurable without decrypting a thing.

01 — the idea

Beat the blocklist, or beat the takedown

A hardcoded C2 domain dies the moment it's on a blocklist. So malware and its operator run the same algorithm against the same seed (often the date) to generate hundreds of candidate domains a day; the operator registers one, the malware tries them all until something answers. You can't pre-block a list you don't have. Fast-flux solves the other problem — keeping the IP alive — by pointing one name at a rapidly-rotating pool of compromised hosts with tiny TTLs.

DGAMachine-minted names: high character entropy, few vowels, long consonant runs, no dictionary meaning. They don't have to be registered to be suspicious — the shape gives them away, and a flood of NXDOMAIN from one host as it probes candidates is the corroborator (Lab 4's R4).

fast-fluxOne name → many IPs, swapped every few minutes (low TTL) across many networks (ASNs) and countries, with no single owner. A legitimate CDN also returns many IPs — but from one operator's ASN. The tell is dispersion + churn, not count.

02 — score a domain

Does this name look machine-made?

Type a domain or pick one. The scorer measures the second-level label live — Shannon entropy, vowel ratio, longest consonant run, length, digit ratio, dictionary hits — and classifies it. No lookup, no registration check: pure shape.

domain

03 — watch it resolve

Fast-flux vs. a CDN

Two domains, each resolved repeatedly over three minutes. Both return a lot of IPs — so counting isn't enough. Run it: the detector scores dispersion (distinct ASNs and countries) and churn (TTL, new IPs per window). The C2 scatters across unrelated networks; the CDN stays inside one operator.

04 — the hard part

Where shape stops being enough

Dictionary DGAs dodge entropy. Some families (Suppobox, Gozi variants) stitch real words together — low entropy, pronounceable, and they sail past a character-shape rule. That's the REVIEW verdict above: you escalate to n-gram improbability, registration age (newly-registered-domain feeds), and whether anyone else on earth ever resolved it.
Encrypted DNS hides the questions. DoH/DoT move resolution inside HTTPS to a third party, so the on-network view of queries disappears. Detection shifts to the endpoint resolver logs and to the TLS metadata — another case of the signal moving a layer when one layer goes dark (cf. Lab 4B's SSH boundary).
The internet is full of weird names. CDNs, hashed asset hosts, and tracking domains look algorithmic. Shape alone over-alerts; you weight it with NXDOMAIN bursts, first-seen/registration age, and reputation before it becomes a finding.
Count ≠ flux. Large services return huge IP pools legitimately. Fast-flux is specifically dispersion across unrelated ASNs with churn — allowlist the big CDNs by ASN/owner and alert on the rest.

A DGA hit or a flux domain is a lead; joined to a beaconing process (Lab 4) and a timeline (Lab 7), it's a C2 channel with a name.

05 — provenance & citations

Where this comes from

research Yadav et al. (2010). Detecting Algorithmically Generated Malicious Domain Names. ACM IMC.
Antonakakis et al. (2012). From Throw-Away Traffic to Bots: Detecting the Rise of DGA-Based Malware (Pleiades). USENIX Security.
Plohmann et al. (2016). A Comprehensive Measurement Study of Domain Generating Malware. USENIX Security.
Holz et al. (2008). Measuring and Detecting Fast-Flux Service Networks. NDSS.

mapping & lab MITRE ATT&CK — Dynamic Resolution: DGA T1568.002, Fast Flux DNS T1568.001; DNS exfiltration ties to T1071.004.
this lab: github.com/Mik3XC/BlueTeamLab
Extends Lab 4 (R4 DNS tunneling) and feeds Lab 7.

Next: Lab 13 — threat-intel pivots: turning one indicator into the adversary's whole infrastructure.