topic DNS Tunneling in Advanced Threat Prevention Discussions

DNS Tunneling

Torito — Wed, 05 Feb 2020 14:39:52 GMT

Im trrying to detect dns tunneling with custom signatures.

i have some snort rules to begin.

some of you have any strategies for this?

Re: DNS Tunneling

OtakarKlier — Thu, 06 Feb 2020 22:51:22 GMT

Hello,

Why not just have a security policy to block it at the application layer?

Just a thought.

Re: DNS Tunneling

CCACieszkowski — Thu, 18 Feb 2021 13:41:09 GMT

Hi@Torito,

Heave you tried converting those signatures, if you want to use them, using the IPS Signature Converter Plugin for Panorama (https://docs.paloaltonetworks.com/pan-os/u-v/custom-app-id-and-threat-signatures/ips-signature-converter-for-panorama.html)? With what result?

Another approach would be to use DNS Security Service (https://www.paloaltonetworks.com/products/threat-detection-and-prevention/dns-security).

Albert

Re: DNS Tunneling

CCACieszkowski — Thu, 18 Feb 2021 13:47:21 GMT

@OtakarKlier

Main reason would be that dns Application Signature does not detect all tunneling and tcp-over-dns Application Signature covers only a small subset of tools (" (...) application identifies traffic from the following tools, tcp-over-dns, dns2tcp, Iodine, Heyoka, OzymanDNS, and NSTX.").

dnscat2 goes through the firewall with ease.

Albert