Detect domain generation algorithms (DGA) with Bro. The module will regularly generate domains by any implemented algorithms and watch for those domains in DNS queries.
This script only works with Bro 2.1+.
cd <prefix>/share/bro/site/ git clone git://github.com/sethhall/bro-domain-generation.git echo "@load bro-domain-generation" >> local.bro
There is no particular configuration required.
There is a single notice type generated by this module:
DomainGeneration::Computed_Domain_Detected