Blocking Malware Callbacks

Reply
Highlighted
L2 Linker

Blocking Malware Callbacks

Malware Callbacks for command&control and also for data exfiltration are often transported in

HTTP POSTs.

 

The URL blocking of category malware URLs seems only to block the HTTP response. The GET or POST request seems to pass untouched to the server. So it is possible to exfiltrate arbitrary data in the GET or POST request.

 

What is the suggested strategie to block connection to hosts listed in the URL category malware before data can be exfiltrated?

 

 

Tags (2)
Highlighted
L7 Applicator

You need to use DNS sinkhole feature.

DNS sinkhole will give fake ip to malware dns requests and then infected pc's try to access this fake ip.

You should use some ip that is not publicly and internally used.

Or you can set up some box on it with wireshark to see exactly what data is sent to this fake ip.

 

https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Configure-DNS-Sinkhole/ta-p/58891

 

1.1.1.1 as sinkhole is really bad idea because this is is really often used for demo purpouses or in software testing so more often than not you see traffic to 1.1.1.1 even without sinkhole so it is dificult to distinguish if it was really infected pc :)

Make up your own ip and monitor traffic log.

Enterprise Architect @ Cloud Carib www.cloudcarib.com
ACE, PCNSE, PCNSI
Highlighted
L2 Linker

Thank you! You are right suggesting sinkholing.

 

I already use DNS sinkhole for but not every URL in category malware seems to be covered with a DNS suspicious signature. 

Only small parts regarding the logs in my environment. Therefore PANW claims a block in the log but a parallel installed IDS shows, that the callback was already transported.

 

Is there another modus which withholds the HTTP Request until the respose is there?

 

Any idea why category malware is not completly covered by IDS signatures?

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!