topic Re: DNS Sinkhole Intended Destination in General Topics

DNS Sinkhole Intended Destination

cleediker — Wed, 17 Aug 2016 13:10:24 GMT

I've configured a DNS sinkhole in our PAN firewall, and it's helped our department identify machines that are trying to reach out to malicious domains and such. Is it possible to identify the original, intended, destination that the user was attempting to reach when they became innfected?

Re: DNS Sinkhole Intended Destination

santonic — Wed, 17 Aug 2016 13:58:02 GMT

If you reslove the URLs in those DNS queries you will get IPs of C&C servers.

The original source of the infection will not be so easy to find.

For start check threat logs with IPs of the infected machines as source or destination. You might also want to check URL logs if it visited some of the suspicious categories (malware, unknown..) if these aren't blocked. If you pinpoint the moment of infection from system logs on the infected device maybe check traffic logs as well. That's as much as you can check on FW. But if the source infection was encrypted connection or USB stick you won't find much info on firewall.

Re: DNS Sinkhole Intended Destination

cleediker — Wed, 24 Aug 2016 12:55:57 GMT

Thanks for the reply, Santonic.