Find the source for "DNS amplification attack response"

[Arman_Zaheri]

Hello,

We receive many "DNS amplification attack response" alerts with the source of our internal DNS servers toward public DNS servers on the Internet. How can we know whether these alerts are not false positives and if they are true positive, how to find the main endpoint responsible for this type of attack?

Thank you all 🙂

[kiwi · Accepted solution]

Hi @Arman_Zaheri ,

The (36029) signature triggers when DNS TYPE is TXT, section is ANSWER, and length between 3800 and 4000 in the response.

Grab the PCAP from the threat log (you might have to enable PCAP in the TID first). 

Send the PCAP over to TAC for analysis.  If this is truly a FP then the signature might have to be updated.

Kind regards,

-Kim.