Detect random sub-domain DNS query

[yarijanto]

Hello,

I would like know if anyone has succesfull creating a custom signature either Custom spyware object or custom vulnerability signature to detect random sub-domain in DNS query.

For example:

We don't want to block www.yahoo.com or yahoo.com domain query.

But if there are query something like abcd1234.yahoo.com, we should detect and alert using Anti-spyware profile.

Can you recommend any solutions on how to solve this issue ?

This is particularly happened in ISP where they need to block this kind of sub-domain query which is not exist actually and consume DNS resources.

Regards,

yarijanto

[Lucky]

Hi Yarianto,

I think from aspect of device OS and custom signatures you could probably craft something that would work for that purpose... you would match dns-req-section with regex pattern, but I am not sure where to start with this signature - you can ask them to give you regex of what they want to block and than test it as custom signature. I am not sure this would be my first approach for problem as you describe it, but I guess it could work, why not. What is their actual complaint, can't it be resolved on the DNS server itself?

Here is manual for custom signatures that explains dns-req-section. Note that at the end of the document you have reference to PAN-OS regex characters - it is a subset of what you would expect and there are no greedy expressions.

Best regards

Luciano