dns based threat hunting
play

DNS-BASED THREAT HUNTING: learn, share and improve. repeat. Joo - PowerPoint PPT Presentation

Dec 08, 2023 •362 likes •643 views

TLP WHITE DNS-BASED THREAT HUNTING: learn, share and improve. repeat. Joo Collier de Mendona @sec_joao Zurich, September 2016. $ whoami Brazilian living in Germany for a long time Since 2010 at Deutsche Telekom CERT / CDC

  1. 
 TLP WHITE DNS-BASED THREAT HUNTING: learn, share and improve. repeat. João Collier de Mendonça @sec_joao Zurich, September 2016.

  2. $ whoami • Brazilian living in Germany for a long time • Since 2010 at Deutsche Telekom CERT / CDC • Based in Bonn, Germany • Network Security & Forensics, Incident Response, Collaboration • I’d rather be sailing :-)

  3. AGENDA • Problem statement • DNS and its features • Patterns: learn, share and improve. repeat.

  4. PROBLEM STATEMENT

  5. 
 THE “WHAT” • Use DNS features ※ to spot malicious activities 
 ※ features in the sense of “characteristics”

  6. THE “WHY” • Networks are ubiquitous, 
 so is DNS FEEDERBOT • Malware uses DNS widely MORTO PLUGX • Organisations frequently do not WEKBY monitor it properly SAURON • Your blind spot is the Source: Cisco 2016 Annual Security Report attacker's sweet spot

  7. MIND OUR SETTINGS • Incident Response • Environment for which there is no traffic baseline • How can I leverage DNS data for detection?

  8. DNS AND ITS FEATURES

  9. METADATA DNS AND ITS FEATURES DNS protocol IP/Network Domain Registration DNS Protocol IP/Network Domain Registration IP addresses 
 ASNs 
 Contacts: registrar, TTL values Response codes Creation date (eg. diversity) (eg. diversity) registrant Parked domains 
 CNAME, NS, SOA, FQDN length FQDN lexical features (eg. A record non- Expiration date Last update MX associations routable address) 2nd-level domain 2nd-level domain Country / Geoloc length lexical features Timing info 
 (eg. queries / sec)

  10. PATTERNS a solid starting point

  11. PATTERN 1 FQDN Length

  12. DNS protocol FQDN LENGTH DNS tunnelling • Look for very long FQDNs • Needed to maximise throughput of a DNS tunnel • As easy as len(str) on a widely available field • Exclude legitimate use: services using disposable hostnames (CDNs, skype, spotify, antivirus, etc)

  13. DNS protocol FQDN LENGTH DNS tunnelling • Field is widely available (and rarely used e.g. on SIEM) • Inspect all FQDN on requests tshark -nn -r $PCAP -T fields -E header=n -E occurrence=a -E quote=n -E separator=',' -e dns.qry.name -Y 'ip and dns and (dns.flags.response==0)'

  14. PATTERN 2 Rate of TXT Records

  15. DNS protocol RATE OF TXT RECORDS DNS tunnelling • Look for endpoints with higher rate of queries for TXT records • Needed to maximise throughput of tunnel • Detected by aggregation of TXT usage by endpoints • Beware of legitimate usage: Mail servers (SPF), domain ownership verification

  16. DNS protocol RATE OF TXT RECORDS DNS tunnelling • Gather DNS replies with TXT records tshark -nn -r $PCAP -Y 'ip and dns and (dns.flags.response==1) and dns.qry.type==0x10' • Create a aggregated (queries and responses) list of top talkers using TXT records tshark -nn -r $PCAP -Y 'ip and dns and dns.qry.type==0x10' -T fields -E header=n -E occurrence=a -E quote=d -E separator=',' -e ip.dst | sort | uniq -c | sort -rn

  17. PATTERN 3 Rate of NXDOMAIN

  18. DNS protocol RATE OF NXDOMAIN DGAs • "DGA-infected" endpoints will generate DNS response with higher rate of NXDOMAIN • Simple rate comparison of NXDOMAIN between endpoints • Exclude legitimate usage, eg. queries for domain.tld.dbl.spamhaus.org

  19. DNS protocol RATE OF NXDOMAIN DGAs • Inspect all responses with DNS NXDOMAIN tshark -nn -r $PCAP -Y 'ip and dns and (dns.flags.response==1) and dns.flags.rcode!=0' • Create a list of unique-domain NXDOMAIN top talkers tshark -nn -r $PCAP -Y 'dns and (dns.flags.response==1) and dns.flags.rcode!=0' -T fields -E header=n -E occurrence=a -E quote=d -E separator=',' -e ip.dst | sort | uniq -c | sort -rn

  20. SHARE A LEARNING while using FQDN Length

  21. FQDN LENGTH: LEARNING kinkasayolmhvmw2ribnf2u24lrjuavaqkzcvua27amab4wyukrifiqspiij.eqwinlrjqafq abnaqqq2xcabveckykybacak5lqkecdamj4cvavsydvfuqbs. 7by.counterbalancegenusonychomys.com. oiltycoonparotid.in lymantriacypresdoctrine.biz counterbalancegenusonychomys.com

  22. FQDN LENGTH: LEARNING $ dig kinkasayolmhvmw2ribnf2u24lrjuavaqkzcvua27amab4wyukrifiqs piij.eqwinlrjqafqabnaqqq2xcabveckykybacak5lqkecdamj4cvav • Don't chase your tail 
 sydvfuqbs.7by.counterbalancegenusonychomys.com. ;; Truncated, retrying in TCP mode. (like I did) [snip] ;; ANSWER SECTION: kinkas...counterbalancegenusonychomys.com. 1000 INCNAME • secretmedia.com: 
 front11.secretmedia.com. front11.secretmedia.com. 3600 IN A 185.42.119.171 front11.secretmedia.com. 3600 IN A 185.42.119.107 ad-blocker bypassing front11.secretmedia.com. 3600 IN A 185.42.119.41 front11.secretmedia.com. 3600 IN A 185.42.119.139 service

  23. THANK YOU FOR YOUR TIME and for ideas during the hop-on, hop-off João Collier de Mendonça @sec_joao Zurich, September 2016.

  24. 
 DNS-BASED THREAT HUNTING: learn, share and improve. repeat. João Collier de Mendonça @sec_joao Zurich, September 2016.

  25. HOP-ON HOP-OFF • Initial Idea was to provide patterns for detection • Feedback to the initial ideas very was nice, thank you! • Hopefully, you will add this patterns to your toolbox!

  26. HOP-ON HOP-OFF • Further patterns collected during hop-on hop-off • Endpoints querying for CNAME and NS record types • Inspect Entropy of FQDNs together with length • For entropy calculation, quick'n'dirty TM , just drop the dots (.) and the calculation over the entire FQDN

  27. THANK YOU FOR YOUR TIME and for ideas during the hop-on, hop-off João Collier de Mendonça @sec_joao Zurich, September 2016.

Recommend

What The HELK? Enabling Graph Analytics for Effective Threat Hunting HELK THP OSSEM Agenda

What The HELK? Enabling Graph Analytics for Effective Threat Hunting HELK THP OSSEM Agenda

What The HELK? Enabling Graph Analytics for Effective Threat Hunting HELK THP OSSEM Agenda Effective Threat Hunting? Current state of threat hunting programs Graph Theory Definition Origins Types Graph

1.69k views • 75 slides
The New Security Frontier: Threat Hunting, Augmented Intelligence, and Automated Response

The New Security Frontier: Threat Hunting, Augmented Intelligence, and Automated Response

The New Security Frontier: Threat Hunting, Augmented Intelligence, and Automated Response Michael Melore, CISSP IBM Cyber Security Advisor @MichaelMelore June 2018 May 2018 May 2018 Threat Hunting Workflow Cognitive Advanced Analytics

443 views • 15 slides
MRO Security Advisory Council (SAC) Webinar One Companys Path to Establishing Threat

MRO Security Advisory Council (SAC) Webinar One Companys Path to Establishing Threat

MRO Security Advisory Council (SAC) Webinar One Companys Path to Establishing Threat Intelligence and Hunting Jamie Buening, Manager, Threat Intelligence and Hunting, MISO August 21, 2019 MRO SAC Update Technical Training and Social

478 views • 45 slides
Advanced Incident Detection and Threat Hunting using Sysmon (and Splunk) Tom Ueltschi, Swiss

Advanced Incident Detection and Threat Hunting using Sysmon (and Splunk) Tom Ueltschi, Swiss

Advanced Incident Detection and Threat Hunting using Sysmon (and Splunk) Tom Ueltschi, Swiss Post CERT Botconf 2016 | Advanced Incident Detection and Threat Hunting using Sysmon and Splunk | Tom Ueltschi | TLP-WHITE Seite 1 C:\> whoami /all

1.34k views • 115 slides
Advanced Incident Detection and Threat Hunting using Sysmon (and Splunk) Tom Ueltschi, Swiss

Advanced Incident Detection and Threat Hunting using Sysmon (and Splunk) Tom Ueltschi, Swiss

Advanced Incident Detection and Threat Hunting using Sysmon (and Splunk) Tom Ueltschi, Swiss Post CERT FIRST-TC 2018 | Advanced Incident Detection and Threat Hunting using Sysmon and Splunk | Tom Ueltschi | TLP-WHITE Seite 1 C:\> whoami

1.73k views • 128 slides
Bridging Security In Intelligence: Hacking, g, Threat Hunting, g, AI, I, Behavioral Anomalies,

Bridging Security In Intelligence: Hacking, g, Threat Hunting, g, AI, I, Behavioral Anomalies,

Bridging Security In Intelligence: Hacking, g, Threat Hunting, g, AI, I, Behavioral Anomalies, and In Incident Response Dangerous Toys USB Device Impersonators USB Killers Man in the Middle Faceplates Wireless Pineapples Payload Phone

727 views • 30 slides
When threat hunting fails Identifying malvertising domains using lexical clustering Tucson,

When threat hunting fails Identifying malvertising domains using lexical clustering Tucson,

When threat hunting fails Identifying malvertising domains using lexical clustering Tucson, January 9th, 2018 Authors kitty Matt Foley David Rodriguez Dhia Mahjoub 2 Background Ad Network Profiling and Filtering Agenda Lexical Clustering

717 views • 45 slides
OSINT: The Secret Weapon in Hunting Nation-State Campaigns alon@intsights.com Alon Arvatz

OSINT: The Secret Weapon in Hunting Nation-State Campaigns alon@intsights.com Alon Arvatz

DETECT . ANALYZE . REMEDIATE OSINT: The Secret Weapon in Hunting Nation-State Campaigns alon@intsights.com Alon Arvatz +972-545444313 1 1 1 What People Think 2 True or False? Threat intelligence Nation-state actors Commercial threat

247 views • 24 slides
Hunting Manufactures and distributes products that enable the extraction of oil and gas Hunting

Hunting Manufactures and distributes products that enable the extraction of oil and gas Hunting

Hunting Manufactures and distributes products that enable the extraction of oil and gas Hunting PLC Global Footprint 2 2009 Corporate Highlights Completed three acquisitions 47.3m Sale of Hunting Energy France 11.1m Year end

857 views • 37 slides
Cyber Security, Threat Hunting and Defense Challenge in Taiwan Academic Network NCHC/TWCSIRT

Cyber Security, Threat Hunting and Defense Challenge in Taiwan Academic Network NCHC/TWCSIRT

Cyber Security, Threat Hunting and Defense Challenge in Taiwan Academic Network NCHC/TWCSIRT Research Fellow Yi-Lang Tsai 1 Google Me. Yi-Lang Tsai ( ) Research Fellow , NCHC (National Center for High-performance

781 views • 49 slides
DESIGN, SIMULATIONS AND ANALYSIS OF AN AIR LAUNCH ROCKET FOR HUNTING LOW EARTH ORBIT'S SPACE

DESIGN, SIMULATIONS AND ANALYSIS OF AN AIR LAUNCH ROCKET FOR HUNTING LOW EARTH ORBIT'S SPACE

DESIGN, SIMULATIONS AND ANALYSIS OF AN AIR LAUNCH ROCKET FOR HUNTING LOW EARTH ORBIT'S SPACE DEBRIS HAMED GAMAL MOHAMED G. ABDELHADY Contents A concept for hunting unburnt space debris 1. Space Debris and the major threat of unburnt debris

294 views • 28 slides
Community benefits from trophy hunting: realities vs pretence by Dr Louise de Waal - EMS

Community benefits from trophy hunting: realities vs pretence by Dr Louise de Waal - EMS

Community benefits from trophy hunting: realities vs pretence by Dr Louise de Waal - EMS Foundation Slide 2 It is generally accepted that the greatest threat to wildlife and nature conservation is the ever- increasing footprint of the human

428 views • 10 slides
Waterfowl Hunting for Beginners by John Martsh R-3 Program Manager Hunting Techniques: Spot and

Waterfowl Hunting for Beginners by John Martsh R-3 Program Manager Hunting Techniques: Spot and

Waterfowl Hunting for Beginners by John Martsh R-3 Program Manager Hunting Techniques: Spot and Stalk Hunting Techniques: Decoying Hunting Techniques: Pass Shooting Gauge Sizes Choke extracted from muzzle Choke lengths and wall diameters

783 views • 29 slides
CWoLa Hunting: Extending the Bump Hunt with Machine Learning Based on: Phys. Rev. Lett. 121,

CWoLa Hunting: Extending the Bump Hunt with Machine Learning Based on: Phys. Rev. Lett. 121,

CWoLa Hunting: Extending the Bump Hunt with Machine Learning Based on: Phys. Rev. Lett. 121, 241803 (2018) [1805.02664] Jack Collins, Kiel Howe, Ben Nachman 1 CWoLa Hunting Outline 1) Machine Learning 2) Model Unspecific Searches 3) CWoLa

668 views • 65 slides
Hunting and detecting APTs using Sysmon and PowerShell logging TOM UELTSCHI BOTCONF 2018 C:>

Hunting and detecting APTs using Sysmon and PowerShell logging TOM UELTSCHI BOTCONF 2018 C:>

Hunting and detecting APTs using Sysmon and PowerShell logging TOM UELTSCHI BOTCONF 2018 C:> whoami /all Tom Ueltschi Swiss Post CERT / SOC / CSIRT since 2007 (over 11 years!) Focus & Interests: Malware Analysis, Threat Intel,

1.45k views • 115 slides
Assessment What is Threat Assessment Threat assessment is the process of gathering

Assessment What is Threat Assessment Threat assessment is the process of gathering

Threat Assessment What is Threat Assessment Threat assessment is the process of gathering information to understand the threat of violence posed by a person. Threat management is the process of developing and executing plans to mitigate

332 views • 15 slides
New physics hunting with top quarks Graldine SERVANT, CERN-TH based on collaborations with

New physics hunting with top quarks Graldine SERVANT, CERN-TH based on collaborations with

New physics hunting with top quarks Graldine SERVANT, CERN-TH based on collaborations with Cline Degrande, Jean-Marc Grard, Christophe Grojean & Fabio Maltoni 1010.6304, JHEP 1104.1798, PLB + 1204.xxxx La Gauthier,

1.51k views • 109 slides
ARM EDITION Matt Spisak REcon 2016, Montreal RECON 2016 ABOUT Offense-based approach to

ARM EDITION Matt Spisak REcon 2016, Montreal RECON 2016 ABOUT Offense-based approach to

HARDWARE-ASSISTED ROOTKITS & INSTRUMENTATION: ARM EDITION Matt Spisak REcon 2016, Montreal RECON 2016 ABOUT Offense-based approach to security and hunting adversaries Research thrusts in malware, threat intel, data science, and

1.4k views • 81 slides
THE LEGALITY OF TIGER FARMING, TROPHY HUNTING AND CANNED HUNTING UNDER INTERNATIONAL LAW Cecil

THE LEGALITY OF TIGER FARMING, TROPHY HUNTING AND CANNED HUNTING UNDER INTERNATIONAL LAW Cecil

THE LEGALITY OF TIGER FARMING, TROPHY HUNTING AND CANNED HUNTING UNDER INTERNATIONAL LAW Cecil the Lion, Hwange National Park, Zimbabwe, 2013 Yann Prisner-Levyne WILD FAUNA= NATURAL RESOURCES UNDER INTERNATIONAL LAW Principle of permanent

400 views • 21 slides
Indigenous Hunting Rights in British Columbia By: Liam Robertson Broken Down Firearm

Indigenous Hunting Rights in British Columbia By: Liam Robertson Broken Down Firearm

Indigenous Hunting Rights in British Columbia By: Liam Robertson Broken Down Firearm Licensing (Briefly) Hunting on Traditional Territory Hunting off Traditional Territory Applying for a FWID and BCEID Metis Hunting in BC

377 views • 13 slides
Phases of Disaster Despair Threat Threat Phase: Small events serve as a warning or threat to

Phases of Disaster Despair Threat Threat Phase: Small events serve as a warning or threat to

Honeymoon Threat Restoration Rescue Phases of Disaster Despair Threat Threat Phase: Small events serve as a warning or threat to normal living. A disaster has not yet oc- curred, but there is a sense of impending doom. Individual

604 views • 6 slides
Partridge driven hunt El Vedat The hunting territory: It is in the middle of Anoia, in

Partridge driven hunt El Vedat The hunting territory: It is in the middle of Anoia, in

TABAKOV TROPHY HUNTING Partridge driven hunt El Vedat The hunting territory: It is in the middle of Anoia, in Catalonia that the hunting area of El Vedat is situated, only 45mn of Barcelona. The territory extends on more than 3000 ha of

385 views • 10 slides
Trophy Hunting- Pakistan A successful community-based programme by Tahir Rasheed

Trophy Hunting- Pakistan A successful community-based programme by Tahir Rasheed

Trophy Hunting- Pakistan A successful community-based programme by Tahir Rasheed Tahir.rasheed200@gmail.com The wild ungulates of Pakistan Pakistan is the most important country for Caprinae conservation Home to 7 species with 11

611 views • 33 slides
The SUSY Twin Higgs Diego Redigolo Higgs Hunting, Paris August 31st based on to appear with A.

The SUSY Twin Higgs Diego Redigolo Higgs Hunting, Paris August 31st based on to appear with A.

The SUSY Twin Higgs Diego Redigolo Higgs Hunting, Paris August 31st based on to appear with A. Katz, A. Mariotti, S. Pokorski and R. Ziegler Neutral Naturalness is by now a well established paradigm to circumvent the null results at LHC

966 views • 47 slides

More recommend