DNS Signature Lists

[DPoppleton]

Does anyone know any free External Dynamic Lists for DNS signatures to use in conjunction with the Palo DNS Signatures? We would like some extra protection for our anti-spyware protection.

[OtakarKlier]

Hello,

Check on these:

Source on PAN support:

https://live.paloaltonetworks.com/message/54183#54183

Sans notes on this:

https://isc.sans.edu/forums/diary/Subscribing+to+the+DShield+Top+20+on+a+Palo+Alto+Networks+Firewall...

Others listed on this site:

http://rules.emergingthreats.net/fwrules/emerging-Block-IPs.txt

http://malc0de.com/bl/IP_Blacklist.txt

http://panwdbl.appspot.com/lists/openbl.txt

http://panwdbl.appspot.com/

http://cinsscore.com/list/ci-badguys.txt

You can also create your won using mindmeld.

Regards,

[DPoppleton]

Thanks, Otakar. These are all IP lists though. I was looking for something for DNS sinkholing or blocking requests for malicious domains.

[OtakarKlier]

Hello,

Another thing to remember is that dns sinkholing is one of serveral defences that the PAN has. It also uses url filtering and I always recommend blocking the following categories:

command-and-control

dynamic-dns

malware

parked

phishing

unknown

Think of the sinkhole as your zero-day threat protection and the URL filter as the classic signature based approach.

Hope that helps.

[BPry]

@DPoppleton,

malwaredomains.com hosts a relatively decent list but it's only available in a zip file to the best of my knowledge, so you would need to do some manual work on your end for that. Otherwise ZeuS hosts one HERE that's updated on a regular basis and can be fed directly to the firewall.