### Overview
SUNBURST employs a highly sophisticated domain generation algorithm (DGA) for its C2 communications, making detection challenging.

### Key Observations
- **Dynamic Domain Generation**: Regularly updates potential C2 domains, reducing the efficacy of static blocking.
- **Encrypted Traffic**: Uses HTTPS for C2 communications to blend in with normal traffic.

### Recommendations
- Implement anomaly-based detection systems to flag unusual domain communications.

### Next Steps
Focus on identifying credential harvesting activities designed for lateral movement within the network.