Blocking Malware Callbacks

[Unibw]

Malware Callbacks for command&control and also for data exfiltration are often transported in

HTTP POSTs.

The URL blocking of category malware URLs seems only to block the HTTP response. The GET or POST request seems to pass untouched to the server. So it is possible to exfiltrate arbitrary data in the GET or POST request.

What is the suggested strategie to block connection to hosts listed in the URL category malware before data can be exfiltrated?

[Raido_Rattameister]

You need to use DNS sinkhole feature.

DNS sinkhole will give fake ip to malware dns requests and then infected pc's try to access this fake ip.

You should use some ip that is not publicly and internally used.

Or you can set up some box on it with wireshark to see exactly what data is sent to this fake ip.

https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Configure-DNS-Sinkhole/ta-p/58891

1.1.1.1 as sinkhole is really bad idea because this is is really often used for demo purpouses or in software testing so more often than not you see traffic to 1.1.1.1 even without sinkhole so it is dificult to distinguish if it was really infected pc 🙂

Make up your own ip and monitor traffic log.

[Unibw]

Thank you! You are right suggesting sinkholing.

I already use DNS sinkhole for but not every URL in category malware seems to be covered with a DNS suspicious signature. 

Only small parts regarding the logs in my environment. Therefore PANW claims a block in the log but a parallel installed IDS shows, that the callback was already transported.

Is there another modus which withholds the HTTP Request until the respose is there?

Any idea why category malware is not completly covered by IDS signatures?