{
  "node_id": "mitre-attack-t1568-002-domain-generation-algorithms",
  "title": "MITRE ATT&CK T1568.002: Domain Generation Algorithms (Enterprise Tactic TA0011 - Command and Control)",
  "domain": "Cybersecurity",
  "version": "1.0.0",
  "last_updated": "2026-05-25",
  "bluf": "MITRE ATT&CK T1568.002 (Domain Generation Algorithms) is an Enterprise Command and Control sub-technique of T1568 (Dynamic Resolution). Adversaries may make use of Domain Generation Algorithms (DGAs) to dynamically identify a destination domain for command and control traffic rather than relying on a list of static IP addresses or domains. This has the advantage of making it much harder for defenders to block, track, or take over the command and control channel, as there potentially could be thousands of domains that malware can check for instructions. Affected platforms: Linux, macOS, Windows. MITRE-documented mitigations include M1031 Network Intrusion Prevention, M1021 Restrict Web-Based Content. The Center for Threat-Informed Defense maps this technique to NIST SP 800-53 Rev 5 controls AC-04, CA-07, SC-07, SC-20, SC-21, SC-22, SI-03, SI-04.",
  "paywall": {
    "status": "LOCKED",
    "unlock_cost_usd": "0.01",
    "skyfire_id": "41779894-ece2-4163-9761-b3b1b76e19b0"
  },
  "crosswalks": {
    "_available_keys": [
      "nist_framework",
      "iso_standard",
      "industry_mapping",
      "mitre_d3fend"
    ],
    "_note": "Full crosswalk values included in vault response"
  },
  "dependencies": [
    "nist-cybersecurity-framework-2-0",
    "iso-27001-2022",
    "nist-sp-800-53-r5",
    "cis-controls-v8",
    "mitre-attack-t1568-dynamic-resolution"
  ],
  "primary_citations_count": 7
}