XDR DNS Query Non-Existant Domain (Internal domain)

[joseph.lim]

Hi Community,

Hope fellows can provide some insights. I have received a suspected DGA alert from my MSSP and upon validating with XDR, it shows Network Services is making such queries. As the domain is my internal domain with gibberish sub-domain, I'm fairly confident this is not a positive DGA incident. What might cause such behavior?

Please note you are posting a public message where community members and experts can provide assistance. Sharing private information such as serial numbers or company information is not recommended.

[etugriceri · Accepted solution]

Hi Joseph, 

Looks like fast flux not DGA but if you dont have so many queries, this might be one of OS binary or service. (might not ofcourse)

I know chrome in some conditions are the root cause of the fast flux but with out doing deep dive analyses on the system, hard to imagine something.