Clankerusecase
MITRE ATT&CK detection coverage
 ← Back to main site
Home/ MITRE Matrix/ Command and Control/ T1568.002

T1568.002Domain Generation Algorithms

T1568.002 — Domain Generation Algorithms is a MITRE ATT&CK technique in the Command and Control tactic. Clankerusecase tracks 11 detection use cases covering it and 9 threat-intel articles citing it.

Command and Control
View on the matrix → Filter Detection Library MITRE official spec ↗
11Use cases
9Articles
0Sub-techniques
1Tactic
↑ Parent technique: T1568 · Dynamic Resolution

Use cases covering this technique (11)

Detect DGA domains using pretrained model in DSDL ESCU actions · hunting P Detect suspicious DNS TXT records using pretrained model in DSDL ESCU actions · hunting P [LLM] OctLurk/SilkLurk/LurkProxy C2 beacon to named backdoor infrastructure Bespoke c2 · hunting DSΣPDDCS [LLM] Starland RAT blockchain fallback C2 via Polygon eth_call (polygon-rpc.com) Bespoke c2 · hunting DSΣPDDCS [LLM] TuxBot fallback C2 via digikalas.online DGA subdomains and DNS TXT queries Bespoke c2 · hunting DSΣPCS [LLM] Egress to typosquatted C2 flipboxstudio.info (Laravel-Lang Composer SC) Bespoke c2 · alerting DSΣPDDCS [LLM] axios RAT C2 callout to sfrclak.com / 142.11.206.73:8000 Bespoke c2 · alerting DSΣPDDCS [LLM] TeamPCP C2 / exfil egress to models.litellm.cloud, checkmarx.zone and AS205759 nodes Bespoke c2 · hunting DSΣPDDCS [LLM] bittensor-wallet 4.0.2 backdoor C2 domain contact (opentensor-* lookalikes) Bespoke c2 · alerting DSΣPDD [LLM] Outbound C2 callback to xygeni-action backdoor IP 91.214.78.178 from CI runner Bespoke c2 · hunting DSΣPDDCS [LLM] PlushDaemon EdgeStepper hijacking infrastructure (wcsset.com / 47.242.198.250 / 8.212.132.120) contact Bespoke c2 · hunting DSΣP

Articles citing this technique (9)

crit OctLurk and SilkLurk: newly identified tailored backdoors in cyber-espionage campaign in Central Asia art-169
crit UAT-11795 deploys novel Starland RAT and bespoke WLDR C2 implant in financially motivated campaign art-256
crit TuxBot v3: Inside an IoT Botnet Framework With LLM-Assisted Development art-267
high Laravel-Lang Supply Chain Attack: Every Tag Across Multiple Composer Packages Rewritten to Steal CI Secrets art-417
crit ESET APT Activity Report Q4 2025–Q1 2026 art-433
high You Patched LiteLLM, But Do You Know Your AI Blast Radius? art-579
crit bittensor-wallet 4.0.2 Compromised on PyPI - Backdoor Exfiltrates Private Keys art-594
high xygeni-action Compromised: C2 Reverse Shell Backdoor Injected via Tag Poisoning art-598
crit PlushDaemon compromises network devices for adversary-in-the-middle attacks art-803