Some time ago, I wrote an article about the differences between AV and E/XDR products. I have another good example that shows why AV products are obsolete. In my previous blog post, I described a DNS tunneling technique used for C2 communication. This article shows how the same activity looks from the host detection perspective.… Read More »AV <-> E(X)DR again…
Some time ago, I did some tests related to DNS tunneling identification. What was wrong with that scenario was that the test was not based on a real-life setup. DNS tunneling happened only inside the infrastructure (LAN environment), without any connection to the Internet or external DNS servers. Such a scenario can influence how vendors… Read More »DNS Tunneling again…
The next part of my DNS protection and identification series – this time focusing on DGA (Domain Generation Algorithm). DGAs are used to evade traditional IOCs such as static domains and IP addresses. How does it work? It’s quite simple: a compromised host continuously generates domain names and sends DNS queries. If one of those… Read More »DNS tunneling vs network security controls part 4 – DGA
DNS is a challenging protocol from a security perspective. We can’t simply block DNS communication due to its recursive nature. If a device needs to communicate with the internet, DNS is essential. Threat actors are well aware of this and often abuse DNS for malicious purposes in various ways. DNS can be used to exfiltrate… Read More »DNS Tunneling vs network security products part 1
Two weeks ago I wrote blog post about importance of DNS visibility – https://letsnet.eu/dns-over-tls-dns-over-https/. Let’s assume that DNS traffic is properly inspected, queries to malicious domains can be seen and you have capabilities to identify DNS tunneling and to block it as well. Is blocking a proper action to malicious DNS queries? Not really, let’s… Read More »DNS Sinkhole