Threat Hunting for Unusual DNS Requests
Searching for Unusual DNS Requests is a standard method for threat hunting. The presence of Unusual DNS Requests can often tip off Information Security professionals to attackers trying to gain entry to their network. This article will detail how Unusual DNS Requests can be of great benefit to Information Security professionals tasked with threat hunting.
Become a certified threat hunter
Indicators of Compromise
Indicators of Compromise (IoC) are pieces of forensic data that identify potentially malicious activity on a network or computer system. IoCs help Information Security professionals to detect data breaches, malware infections, or other threats on their respective networks. This, in turn, allows organizations to detect attacks and respond in a timely fashion to prevent breaches from occurring or limit damages by stopping attacks as early as possible.
Unusual DNS Requests is considered to be a standard IoC item used by Information Security professionals for threat hunting. This is because patterns left by malicious DNS queries are glaring red flags that an organization is about to be breached.
According to Wade Williamson, senior security analyst at Palo Alto Networks, “Command-and-control traffic is often the most important traffic to an attacker because it allows them ongoing management of the attack and it needs to be secure so that security professionals can't easily take it over. The unique patterns of this traffic can be recognized and is a very standard approach to identifying a compromise." With this said it is clear why Unusual DNS Requests are a key indicator that data compromise is imminent.
Why DNS?
DNS is one of the major pillars that powers the Internet. Everything that is online uses DNS as a common practice. This includes web browsers, web apps, and even malware. The Malware needs to communicate to its master server for instructions and attackers are well versed in using DNS tricks to avoid detection.
Unusual DNS Requests
The following Unusual DNS Requests are commonly used for threat hunting:
- Unusual DNS query failures
Typically, malware that is on a network will beacon out to its master server for attack instructions by using a domain name. Attackers usually try to stay on the network as long as possible by using a domain name until they are detected. Since Information Security professionals can simply block the connection once discovered, attackers tend to use DGA (Domain Generation Algorithms) to evade detection and blockage. These algorithms allow attackers to escape detection by generating random domain names.
This one could end up being the dead ringer that tips you off to a possible breach from a threat. Domains that looks as though they have been generated randomly such as dfkddd.com or eijresfdfd.net or even containing an IP address, such as 108.172.16.201.gogle.com should set off some alarms.
Domains such as this should be analyzed with what is called the Rinse and Repeat method. Rinse and Repeat is where you analyze the traffic in your logs, define what is normal traffic (also called whitelisting), remove it from your logs and then analyze again. This will most likely show you where your investigation should kick off at.
Often, these DNS requests will come from parts of the world such as Russia or parts of the South Pacific, with top-level domains of .ru and .tk respectively. This traffic should be suspect when they are involved in any suspicious DNS request activity.
Most employees do not need to send DNS requests when they are not in the office or when it is not during business/office hours.
The volume of DNS traffic per IP or per domain can signal connections to command and control master servers. When you see an abnormal volume of these DNS queries, you should be on alert that a threat may be present.
Another good indicator of whether your network is under threat is by looking to see if there are any instances of denies outbound traffic. Despite the best efforts of your Information Security team, threats still may make their way into your network. This is problematic, but it is entirely detectable and can be used to find threats that are present.
What happens is once a threat is on a network, it still will need to communicate with its master server. This communication is often choked out by firewalls and other network security devices. Once this happens, keep a level head, and investigate where the outbound communication originated. Modern network security devices normally have no problem with detecting and stopping this traffic and professionals tasked with threat hunting should use this traffic data to help them begin their investigation if they haven’t already.
Conclusion
Unusual DNS Requests, while alarming, should be used by Information Security professionals to hunt down threats on their respective networks. While attackers may be using tricks to get around being detected, by investigating a combination of the unusual DNS requests above you should be able to begin a successful threat investigation at least if not conclude it.
References
https://cyber-ir.com/2016/03/01/cyber-threat-hunting-3-hunting-in-the-perimeter/
https://www.endgame.com/blog/technical-blog/hunting-cheap-part-1-architecture
https://www.recordedfuture.com/cyber-threat-hunting/
Become a certified threat hunter
https://cyber-ir.com/2016/04/06/the-evil-side-of-dns/
In this Series
- Threat Hunting for Unusual DNS Requests
- Compromise assessment or threat hunting? What do organizations need?
- Deception technologies: 4 tools to help you identify threats and mitigate risks
- Threat hunting with Kolide and osquery
- Threat hunting with osquery
- Threat hunting with Cymon API
- Threat hunting with Graylog
- Threat Hunting: Remediation
- Threat-hunting techniques: Conducting the hunt
- Top 10 Free Threat-Hunting Tools
- Threat Hunting: Data Collection and Analysis
- Threat Hunting: Detecting Adversaries
- Threat Hunting: Detecting Threats
- 10 Tips for Effective Threat Hunting
- How to Conduct a Threat Hunt – 10 Steps
- Threat hunting maturity model
- Best Practices for Threat Hunting in Large Networks
- VERIS INCIDENT FRAMEWORK
- Threat Hunting for Mismatched Port – Application Traffic
- Threat Hunting for File Hashes as an IOC
- Threat Hunting for File Names as an IoC
- Threat Hunting for URLs as an IoC
- Threat Hunting for Domains as an IOC
- Threat Hunting and HTML Response Size
- Threat Hunting for Unusual Logon Activity
- Threat Hunting for Swells in Database Read Volume
- Threat Hunting for Anomalies in Privileged Account Activity
- 5 Commercial Threat-Hunting Platforms That Can Provide Great Value to Your Hunting Party
- Threat Hunting for Suspicious Registry and System File Changes
- Threat Hunting for DDoS Activity and Geographic Irregularities
- The Current Job Outlook for Threat Hunters
- How to Build a Threat-Hunting Tool in 10 Steps
- Threat Hunting and SOC
- Threat Hunting vs. SIEM
- 10 Benefits of Threat Hunting
- Threat Hunting Techniques
- Threat Hunting Methodologies
- Threat hunting: IOCs and artifacts
- How to Become a Threat Hunter
- Threat-Hunting Process
- The Ultimate Guide to Threat Hunting
Get certified and advance your career!
- Exam Pass Guarantee
- Live instruction
- CompTIA, ISACA, ISC2, Cisco, Microsoft and more!
Threat hunting
Threat hunting