topic Honey pot recommendation for DNS sink holing in General Topics

Honey pot recommendation for DNS sink holing

idelconsulting — Thu, 16 Jun 2022 21:33:18 GMT

Dear all,

we are seeing many DNS alerts for spyware, but we don't have any DNS logs.

Also, internal hosts can't resolve external FQDNs, so probably most of the requests are coming from the proxy.

So we are thinking about setting up DNS sink holing with a honey pot.

Any recommendations what to use as a honey pot so that we can get the most information possible from the client connecting to it?

Thanks and Regards,

Andreas

Re: Honey pot recommendation for DNS sink holing

Buck_Smooth — Fri, 17 Jun 2022 20:25:46 GMT

Not a honeypot but Pi-Hole is what I use for both DNS sinkhole and primary DNS server in some cases. I run it in VMware on CentOS8 or on a Raspberry Pi.

Re: Honey pot recommendation for DNS sink holing

OtakarKlier — Mon, 20 Jun 2022 17:12:12 GMT

Hello,

DNS logs are a big deal. Have you looked into the following article to ensure sinkhole setup correctly and logging correctly:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClGECA0

Also I recommend using a secure DNS resolver for anything external.

Here is a link to a video I made for a conference about DNS:

https://youtu.be/ROIAYSEbTuo

Regards,