topic Re: Spyware with DNS Protection in Advanced Threat Prevention Discussions

Spyware with DNS Protection

Khai-Huynh — Wed, 03 Jun 2020 05:00:35 GMT

Hi All,

Our Firewall drop DNS traffic of C&C ( us.jaxonsorensen.club, news.sqllitlerver.info & log.osloger.biz) with source IP Address of Firewall. This issue after update the Threat 28/05/2020.

Will appreciate any help/suggestions.

Best regards,

Khai

Re: Spyware with DNS Protection

mivaldi — Wed, 03 Jun 2020 16:22:44 GMT

This can be caused by the firewall running DNS proxy, or attempting to fill out the IP information in pre-defined threat reports. Check your Threat logs to see if these domains have been observed, and verify the threat reports to see if any generated reporting the malicious domain findings.

Re: Spyware with DNS Protection

Khai-Huynh — Thu, 04 Jun 2020 02:11:58 GMT

Thanks Mivaldi,

The problem here, I didn't configuration about the DNS Proxy. I checked all host in our network nothing query to spyware DNS. Only Firewall Palo alto request.

Thanks,

Khai

Re: Spyware with DNS Protection

mivaldi — Thu, 04 Jun 2020 16:51:15 GMT

Check your URL Filtering logs.

Re: Spyware with DNS Protection

MP18 — Sat, 13 Jun 2020 18:47:45 GMT

I tested these and see that PA blocks them under threat as type spyware.

Source address is my PC and it is working as expected as i have dns sinkhole configured.

You will not see any traffic for these sites under url as it sinkholed.

Re: Spyware with DNS Protection

mivaldi — Mon, 15 Jun 2020 20:43:26 GMT

@MP18 I think you got lost in the train of thought. @Khai-Huynh is saying that the DNS sinkhole actions are showing up for traffic where the firewall management IP is the source of the DNS queries. @Khai-Huynh is hinting that the firewall could be compromised since there should not be a reason for it to source queries to malicious domains. What I am saying here is that this is not a sign of a compromised firewall, since queries to malicious domains may happen when the firewall generates Threat Reports. Some of these threat reports are based on URL Filtering malware category detections (for example), and the firewall will source a DNS query to fill out IP address information in the Threat Reports (that may subsequently get caught in the Anti-Spyware DNS profile).

Re: Spyware with DNS Protection

Khai-Huynh — Tue, 16 Jun 2020 02:06:20 GMT

Hi @mivaldi,

That's good ideas. I have a rules for blocked APT with malware url. Threat stopped when i disabled it.

So many thanks

Khai