More than 90% of malware, somehow, for their goals use DNS – a foundational service of any network, which is often not considered from a security perspective and, even worse, is able to reach malicious servers that can exfiltrate and infiltrate data into the network. During this speech we will discuss a machine-learning base countermeasure that can also be used to optimize SOC’s work, interacting directly with many cyber security vendors like FireEye, Forescout, Fortinet, PaloAlto/Cortex, Proofpoint and others.