Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Connecting the Dots in Cyber Threat Campaigns, Part 2: Passive DNS

Summary: Unit 42's second-part series explains Passive DNS, a technology created by Florian Weimer in 2004 and introduced widely at the FIRST conference in 2005, which captures DNS answer messages into a central database logging the queried domain, the answer and a timestamp. In a July 2015 article on an attack on the US government by the APT group UPS, also known as APT3, the team found subdomains rpt.perrydale[.]com and report.perrydale[.]com mapped to a Ukrainian IP while the legitimate www subdomain was hosted in the United States, and a PDNS search on that IP surfaced three additional suspect subdomains.

Key Takeaway: A PDNS sensor only sees queries made inside the network it monitors, so if a malicious domain was never queried on your network, you have no data on it at all - which is why analysts lean on aggregating sources such as FarSight and PassiveTotal to widen the view.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related