Learn how to effectively investigate, contain and remediate this incident by following our Response Playbook.

Traditional threat intelligence relies heavily on known Indicators of Compromise (IoCs) to block malicious activity. However, cyber adversaries actively bypass these defenses using Domain Generation Algorithms (DGAs) embedded within malware families. These algorithms dynamically generate a large number of pseudo-random domain names on the fly. Because these domains are entirely new and constantly changing, they will never appear on standard threat intelligence blocklists, creating a massive blind spot for conventional security stacks.

These generated domains serve a specific, dangerous purpose: they act as highly resilient backup Command and Control (C2) channels. By querying thousands of random domains, infected hosts can successfully maintain communication with adversarial infrastructure even if their primary C2 domains are blocked or taken down.

Lumu fills this critical gap in traditional threat intelligence by shifting the focus from static lists to behavioral analysis. Lumu continuously monitors network metadata for the anomalous pattern of endpoints querying massive volumes of randomized domains. Once this anomaly reaches a high confidence threshold, it is automatically elevated into a confirmed DGA Incident.

By detecting this algorithm-driven activity, Lumu provides immense value by delivering visibility into three critical areas:

• Active endpoint compromises: The strange behavioral pattern of generating and querying pseudo-random domains acts as a clear, undeniable indicator that an adversary has successfully infected a device.
• C2 resilience mechanisms: Uncovers the attacker's fallback infrastructure, providing visibility into the specific list of algorithmically generated domains that the malware is attempting to reach.
• Malicious connection volume: Offers quantitative tracking of the exact number of contacts an infected endpoint makes to these generated domains over time, helping analysts gauge the intensity of the beaconing.

This document outlines how the Lumu Portal delivers valuable insight into the detection of this attack by providing the necessary context to support the decision-making of your organization's response team.

Collected Data

To facilitate forensic analysis and scope determination, the Lumu Portal captures specific metadata fields regarding the algorithm-driven behavior. The data collected for this incident includes:

• Affected endpoint: The specific internal host or IP address generating the DGA queries.
• Generated domains: The full list of pseudo-random domain names (e.g., x89k21a0z.biz, p39lm11q.info) queried by the infected endpoint.
• Contact frequency: The total volume of connection attempts made to each generated domain.

Incident Details

The Lumu Portal delivers the collected data to facilitate rapid triage and decision-making. The data is displayed as follows:

1. Summary
This section highlights critical timeline and operational metrics. It displays the First Contact and Last Contact timestamps, alongside the Time to Respond and Incident Duration. This data establishes a general scope of the incident, allowing analysts to identify exactly when the automated queries began and how long the endpoint has been compromised.

2. Dynamic Resolution Activity
This section aggregates the most relevant data regarding the anomalous queries. It quantifies the severity of the compromise by displaying the highly randomized domains alongside the volume of connection attempts originating from the host.

• Activity Metrics: Displays the total count of unique generated Domains and the overall number of Contacts made by the endpoint.
• Contact Behavior: An interactive radial (polar) chart that maps connection attempts across the days of the week and hours of the day. Because DGA tunneling relies on mathematical algorithms, this visualization allows analysts to easily spot automated, non-human beaconing patterns. You can toggle specific days on or off to isolate activity and spot recurring frequency spikes.
• Sample Domains: Provides a quick-glance list of the pseudo-random domain names (e.g., 53iaqrqfxue69or.xyz) generated by the algorithm.
• Contacts List: A granular, chronological breakdown of every connection attempt. It displays the exact date and time, the specific randomized domain queried, and the DNS response received (e.g., NOERROR), allowing for precise forensic tracking.

Incident Data Export

While the Lumu Portal displays the most critical data points—such as the top attacking sources and target users—complex attacks often involve volumes of traffic that exceed what can be efficiently displayed on a single screen. For that reason, the Lumu allows in-depth investigations with its Export Feature. It allows analysts to move beyond the high-level summary and access the complete forensic dataset of the incident.

You can export data using the download button located at the top of the page (1) or using the button below the Summary section (2).

Exportable Data

You can export the complete dataset of the incident lifecycle using the following options:

• Download all activity (.csv): Located directly within the Dynamic Resolution Activity section, this button extracts the full list of algorithmically generated domains, timestamps, and DNS responses. Downloading this raw dataset serves as the master record for your investigation. This data can be ingested into your EDR or SIEM tools to uncover the specific malware strain responsible for executing the algorithm, remove the executable file, clear associated persistence mechanisms, and update endpoint protection rules.