topic Regarding sinkholed hosts in General Topics

Regarding sinkholed hosts

MRamadanAHafiez — Sun, 16 May 2021 15:13:52 GMT

Hello Bros,

We have subscribed to palo alto dns-security and the license has been applied to the device.

Rules with anti-spyware "dns-security sinkhole action enabled".

Now regarding the hosts with sinkhole action, that means these hosts trying to connect to a malicious domains.

These trials blocked but is these another recommended actions to be taken towards these hosts? Is there a recommended method to stop them from trying to connect to these malicious domains?

TIA

Re: Regarding sinkholed hosts

Remo — Sun, 16 May 2021 15:52:14 GMT

Hi @MRamadanAHafiez

The recommendation would be to check these hosts if there is some sort of malware/spyware running which tries to connect to these domains. With the sinkhole feature it shows you these hosts which otherwise wouldn't be identified.

The little problem is to differentiate if it really was some sort of malware or only connections done by the users browsers which probably are the reason for most of the sinkholed connections. It's not that (my assumption) that users directly connect to these domains, these requests are because of advertisements on the actual websites or because of malicious scripts somehow get executed on the websites that the users open.

So there is no way to fully stop clients connecting to domains whitch are redirected to the sinkhole, but it still is a very helpful feature to identify clients which should be checked.

Re: Regarding sinkholed hosts

MRamadanAHafiez — Mon, 17 May 2021 23:40:28 GMT

Thank you so much Bro.

Re: Regarding sinkholed hosts

JasonPeterson — Thu, 29 Jul 2021 12:58:59 GMT

If you are using XDR you can setup an IOC to alert when a client connects to the sinkhole IP. Then put an exclusion on the the alert if it is coming from a browser and then investigate any endpoint that has a process other than a browser connecting to the sinkhole.

Re: Regarding sinkholed hosts

MRamadanAHafiez — Fri, 30 Jul 2021 12:23:38 GMT

Thank you for participation but unfortunately we don't have XDR.