FreqServer is based on and (originally created by Mark Baggett).
Thanks to Justin Henderson for all his work with the FreqServer docker image!


Mark Baggett’s (@MarkBaggett - GSE #15, SANS SEC573 Author) Awesome-Sauce tool for detecting randomness using NLP techniques rather than pure entropy calculations. Uses character pair frequency analysis to determine the likelihood of tested strings of characters occurring based upon the chosen frequency tables (some prebuilt English text freq tables provided). Extremely useful for detecting high entropy where it shouldn’t be. Especially powerful for discovering DNS based DGAs commonly used for malware C2 and exfiltration. Think bigger than DGAs though. Random file names, script names, process names, service names, workstation names, TLS certificate subjects and issuer subjects, etc.

From is a multithreaded web based API that will allow you to quickly query your frequency tables. The server isn’t intended to replace Instead, after building a frequency table of normal strings in your environment with, you start a server up to allow services to measure various strings against that table. You can run multiple servers to provide access to different frequency tables.


For information on how to modify configuration for FreqServer, please see

FreqServer is currently disabled by default.