DNS Tunneling

[Torito]

Im trrying to detect dns tunneling with custom signatures.

i have some snort rules to begin.

some of you have any strategies for this?

[OtakarKlier]

Hello,

Why not just have a security policy to block it at the application layer?

Just a thought.

[CCACieszkowski]

Hi@Torito,

Heave you tried converting those signatures, if you want to use them, using the IPS Signature Converter Plugin for Panorama (https://docs.paloaltonetworks.com/pan-os/u-v/custom-app-id-and-threat-signatures/ips-signature-conve...)? With what result?

Another approach would be to use DNS Security Service (https://www.paloaltonetworks.com/products/threat-detection-and-prevention/dns-security).

Albert

[CCACieszkowski]

@OtakarKlier 

Main reason would be that dns Application Signature does not detect all tunneling and tcp-over-dns Application Signature covers only a small subset of tools (" (...) application identifies traffic from the following tools, tcp-over-dns, dns2tcp, Iodine, Heyoka, OzymanDNS, and NSTX.").

dnscat2 goes through the firewall with ease.

Albert