Skip to content
This repository has been archived by the owner on Sep 7, 2022. It is now read-only.

Files

Latest commit

fa3a4dd · Feb 22, 2018

History

History
37 lines (23 loc) · 904 Bytes

README.rst

File metadata and controls

37 lines (23 loc) · 904 Bytes

THIS SCRIPT LIKELY NO LONGER APPLIES TO THE WORLD. IT'S IMPLEMENTING A DGA FOR VERY OLD MALWARE THAT IS LIKELY NO LONGER PRESENT IN THE WILD.

I'm only leaving the repository here because it's possible for someone to learn something from the scripts.

Domain Generation Algorithm for Bro

Detect domain generation algorithms (DGA) with Bro. The module will regularly generate domains by any implemented algorithms and watch for those domains in DNS queries.

This script only works with Bro 2.4+.

Installation

cd <prefix>/share/bro/site/
git clone git://github.com/sethhall/bro-domain-generation.git
echo "@load bro-domain-generation" >> local.bro

Configuration

There is no particular configuration required.

Output

There is a single notice type generated by this module:

DomainGeneration::Computed_Domain_Detected