topic Re: Suspicious DNS Query in General Topics

Suspicious DNS Query

CarthageCollege — Fri, 28 Mar 2014 15:28:25 GMT

Hi All -

Looking through my threat monitor and I am seeing a lot of Suspicious DNS Query entries in there. I have two internal DNS servers, and the entries are for both of them -- the drop-all-packets action is being taken, so it's good the PA is stopping them. If I had to take a guess, 90% of the entries in my entire threat monitor are the Suspicious DNS Query entries. I've scanned and scanned and scanned my DNS servers (both Windows 2003 Server) for viruses and malware, but nothing is ever found. I'm concerned about these even though the packets are being dropped. Should I not be worried about them, is there something I can do to prevent them, or is it just the nature of DNS to query sites -- some of which may be associated with malware -- and I can't do anything?

Thanks!

Max

Re: Suspicious DNS Query

CarthageCollege — Fri, 28 Mar 2014 15:51:40 GMT

OK. Perhaps I posted that too soon.

I just found this: Suspicious DNS Query - how to find source computer?.

It looks like the query isn't coming from my DNS server, but a host using my DNS server. You can enable debugging on your DNS server and find the source computer. I think it all makes sense now!

Max

Re: Suspicious DNS Query

jvalentine — Fri, 28 Mar 2014 16:51:41 GMT

The new DNS Sinkholing feature in PAN-OS 6.0 can help you identify the client that requested the malicious DNS entry without having to go to the DNS server.

Re: Suspicious DNS Query

sbabu — Fri, 24 Oct 2014 15:28:01 GMT

Hi,

When the DNS sinkhole feature is configured on the Palo Alto Networks firewall and the client system is using an external DNS server, the DNS query from the client will go through the Palo Alto Networks firewall to the external DNS server (client and DNS server are in different subnets). As expected, the user should be able to see threat logs with the client IP address as a source. However, if a client system is using an internal DNS server (client and DNS server are in the same subnet), the DNS query from the client will go to the internal DNS server. The internal DNS server will forward this query to an external DNS server, and threat logs with the internal DNS server IP address will be seen as a source when accessing malicious website. Please find the below document for your reference.

DNS Sinkhole Process with Internal DNS Server

Regards,

Sarath