Domain generation algorithm
Malware derives many domains so blockers lag. Hunt high NXDOMAIN and labels that look generated, not a brand.
A domain generation algorithm lets malware compute a large set of domain names from a seed, often tied to the date. The operator only needs to register a few. Blocklists that chase yesterday's name miss tomorrow's.
Hunt bursts of NXDOMAIN from one host, labels that look algorithmic (long, high entropy, odd character runs), and rare TLDs. Pair with process and network context. This is a detection idea, not a generator.
See also: DNS, Botnet, Indicator of compromise, Threat hunting.