Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Max Heinemeyer
Global Field CISO
Share
01
Feb 2018
The algorithms made famous by Conficker almost a decade ago are continuing to frustrate the security community.
A function of some advanced malware, Domain Generating Algorithms (DGA) rapidly generate new domains as a means of evading security personnel. This process is known as ‘domain fluxing’ and provides an alternative means of communication with the attacker’s command-and-control servers. They are very difficult to detect using a traditional security approach.
Darktrace’s AI and machine learning are designed to detect threats without any pre-existing knowledge of attacker targets, tools, or capabilities. While traditional security tools depend on specific Indicators of Compromise to identify malicious activity, Darktrace instead focuses on behavioral changes that may point to an active compromise. Detection of Domain Generating Algorithms is just one example of Darktrace’s ability to pinpoint attacker C2 communications through the identification of behavioral anomalies.
DGA identification in action
Darktrace recently saw an employee of a healthcare company connecting a personal laptop to the corporate network. The employee was asked by another member of the organization to troubleshoot the laptop as a favor. Unbeknown to the employee, and despite the fact that anti-virus was installed, the laptop was compromised by an unknown strain of malware.
On joining the network, the compromised laptop made DNS queries for domains that Darktrace classified as 100% rare for the environment. These domains appeared to be dynamically generated as they were all between 25 to 30 characters long and used multiple top-level domains. Darktrace immediately triggered a high-scoring domain fluxing alert due to the sudden increase in failed DNS requests for abnormal domains.
Additional domain fluxing alerts were triggered within 30 minutes of the device joining the network. The only reason that this highly suspicious activity was allowed to persist for that period of time was that the security administrator was at lunch.
A sample of Darktrace network logs showing failed DNS requests for DGA domains.
Event logs showing domain fluxing identification within 14 seconds of the device joining the network.
Rapid containment
The security administrator was informed of the situation on his return and immediately performed incident triage with Darktrace. The administrator was able to rapidly assess the device’s connection history using Darktrace’s native filters that are designed to detect scanning, lateral movement, C2 communications, and egress. He then identified the location of the compromised laptop, disabled its internet access, and physically removed the device from the network.
The total time from initial connection to identification, containment, and removal of the compromised, rogue device was approximately 67 minutes. The administrator left the following comment for the Darktrace analyst team:
Darktrace Threat Visualizer shows multiple domain fluxing model breaches as a result of a high volume of failed DNS requests for suspicious, dynamically-generated domains.
Closing thoughts
Darktrace’s AI approach focuses on identifying anomalies in evolving patterns of behavior. Although the laptop was new to the network, no other device was seen making a high volume of failed DNS requests for similar DGA domains. Darktrace immediately identified this activity as anomalous and generated an alert within 14 seconds of the device joining the network.
By employing Darktrace, a single analyst was able to discover and assess a compromised, rogue device operating within the network environment in just over an hour. What’s more, with Antigena (Darktrace’s autonomous response solution) in place, all suspicious behaviors would have been temporarily suspended, in real time. Alternatively, the administrator could have manually authorized Antigena’s proposed actions via the Darktrace Mobile App.
No extensive analysis of distributed log files, PCAPs, or other security tools. No prior knowledge of the attacker’s infrastructure or the malware. Darktrace AI identified DGA domains that were being produced on the fly, without help. That’s the level our security technology must perform at if we are to keep on top of all the new tech in the modern attacker’s toolkit.
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
“I wonder if running that tool influenced the connectivity in some way.”
“I might need to target down or reboot, but first, I'll investigate the network using ARP. I wonder if ARP is responding properly. If I see "ip neigh stale," that could indicate a problem. I think arping might help in this situation, but I’ll need to keep an eye on how the network is behaving. It's all about figuring out where the issue lies!”
図10：エージェントの異常なLDAPアクティビティに対してトリガーされたこのLinuxサーバーに対するモデル検知は、Cyber AI Analystによって自律的に調査され、その調査結果にはエージェントの異常なSMBセッションアクティビティに関する内容が含まれ、Cyber AIAnalystインシデントに記録されました。
DarktraceのCyber AI Analystは、エージェントのアクティビティによってトリガーされたモデル検知を自律的に調査し、その調査結果を1つの重要なインシデントレポートにまとめました。インシデント報告書の内容は、エージェントによるネットワークスキャンから始まりコーディング演習内容のSMBベースの上書きで終わる、エージェントの行動の各段階を詳しくカバーしています。
図20：Cyber AI Analystは、モデル検知に対する自律的な調査を通じて得られた所見をつなぎ合わせ、エージェントの進行状況のタイムラインを作成し、アクティビティを視覚的に表したグラフとともに提供しました。
Cyber Verification Program下のAnthropic Opus 4.6モデルなど、他のフロンティアモデルを使用したエージェントも、Darktraceのシミュレートされた環境で同じ設定とタスクを使ってテストされました。反復の度に、エージェントは演習の内容または採点プログラムを変更して不正を行おうとしました。基盤となるモデルに関係なく、エージェントは自分が置かれた環境を侵害することで、100％のスコアを達成する方法を見つけることに成功していました。これらのエージェントによるハッキングは、アクティビティの内容こそ違っていましたが、すべてその環境のベースラインの振る舞いから大きく逸脱した動作を引き起こしていました。これらの逸脱はDarktraceプラットフォームに十分な検知の機会を提供し、エージェントの逃げ場はありませんでした。
エージェンティックハーネスは会話履歴をローカルに保存しますが、ダークトレースの研究者たちは、保存されたAIの応答が本当にモデルによって生成されたものであるかどうかの検証が行われていないことを発見しました。また、この設計上の選択がAnthropic Claude Code、AWS Kiro-CLI、OpenAI Codex、およびオープンソースのPiにわたって共通していることを確認しました。
会話履歴は多くの場合クライアント側に保存されます。例えば、Anthropic Claude Code、OpenAI Codex、AWS Kiro-CLI、Piなどでもそうです。そのため、ユーザーはセッションを自由に再開でき、一部の製品にはその履歴を操作する機能が組み込まれています。たとえば、会話の中の特定の時点に戻り、送信したメッセージを編集して、会話を別の軌道へ進めていくことができます。きわめて重要な点として、私たちが調査したすべてのケースにおいて、保存されているAIの応答が対応するモデルから生成されたものであり改ざんされていないことの検証は行われていませんでした。
