Additional information on GuardDuty DNS Findings

0

I am receiving DNS related GuardDuty findings for "querying algorithmically generated domains" that we suspect are not algorithmically generated.

An example URL is from the following Facebook page: https://www.facebook.com/SOMD-167556163301693/

The URL in question is http://stuckonmsdawn.com/

So my questions:

  1. Why is GuardDuty flagging this as algorithmically generated?
  2. Is there a way of checking with AWS whether they think a domain is algorithmically generated (or as part of a "Command & Control server" also) before actually making the DNS query itself?

Thanks

MaxEB
asked 2 years ago896 views
1 Answer
1

There are 2 types of DGA related GuardDuty findings i.e. DGADomainRequest.B and DGADomainRequest.C!DNS.

For this finding EC2/DGADomainRequest.B: it is based on analysis of domain names using advanced heuristics and may identify new DGA domains that are not present in threat intelligence feeds. If you believe the domain has been incorrectly identified, please raise a technical support ticket with AWS support.

For this finding DGADomainRequest.C!DNS: it is based on known DGA domains from GuardDuty's threat intelligence feeds.

Please refer to this link for additional details of the DGA related findings.

profile pictureAWS
answered 2 years ago
  • Finding a lot of this lately, does not seem very intelligent. Lots of false positives.

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions