XDR DNS Query Non-Existant Domain (Internal domain)

joseph.lim — Fri, 03 Feb 2023 04:30:40 GMT

Hi Community,

Hope fellows can provide some insights. I have received a suspected DGA alert from my MSSP and upon validating with XDR, it shows Network Services is making such queries. As the domain is my internal domain with gibberish sub-domain, I'm fairly confident this is not a positive DGA incident. What might cause such behavior?

Please note you are posting a public message where community members and experts can provide assistance. Sharing private information such as serial numbers or company information is not recommended.

Re: XDR DNS Query Non-Existant Domain (Internal domain)

etugriceri — Tue, 07 Feb 2023 10:33:12 GMT

Hi Joseph,

Looks like fast flux not DGA but if you dont have so many queries, this might be one of OS binary or service. (might not ofcourse)

I know chrome in some conditions are the root cause of the fast flux but with out doing deep dive analyses on the system, hard to imagine something.

topic Re: XDR DNS Query Non-Existant Domain (Internal domain) in Cortex XDR Discussions

XDR DNS Query Non-Existant Domain (Internal domain)

Re: XDR DNS Query Non-Existant Domain (Internal domain)