Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Toward Ending the Domain Wars: Early Detection of Malicious Stockpiled Domains

Summary: Unit 42 built a Random Forest detector using over 300 features drawn from certificate transparency logs and passive DNS to identify stockpiled domains, and as of July 2023 its pipeline had found 1,114,499 unique stockpiled root domain names while identifying tens of thousands of malicious domains weekly. The model flagged stockpiled domains an average of 34.4 days earlier than vendors on VirusTotal, and later content and behavior analysis identified 45,862 malware, 8,989 phishing and 844 C2 domains among them.

Why it matters: A 34.4-day head start on domains attackers have already registered but not yet used is the difference between blocking a campaign at patient zero and responding after it lands, and the detector's 99% precision at 48% recall means a meaningful share of stockpiled infrastructure still goes unseen.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related