A Zeek analyst reviews logs and finds repeated DNS queries from an internal host to randomly-generated domain names that all resolve to the same external IP. What attack technique does this MOST likely indicate?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — when you see repeated DNS queries to randomly generated domains that all resolve to the same external IP, that's classic domain generation algorithm malware beaconing to a command-and-control server. The malware is trying pseudo-random names until one hits an active attacker-controlled address.
Full Explanation
The domain generation algorithm based malware communicating with a command-and-control server is correct because malware using a domain generation algorithm generates large numbers of pseudo-random domain names, attempting to contact one that resolves to an active command-and-control server. The pattern of many random domains resolving to the same external IP is the classic indicator of that technique. DNS cache poisoning is wrong because it involves corrupting cached records, not generating random query names. A DNS amplification attack originating from the internal host is wrong because amplification attacks use external DNS servers as reflectors and produce high-volume responses rather than repeated random-domain lookups resolving to one address. A misconfigured DNS resolver causing NXDOMAIN flooding is wrong because that condition would show queries failing with NXDOMAIN responses, not resolving to the same external IP.