DNS in Enterprise IR: Collection, Analysis and Response

Presented at DerbyCon 6.0 Recharge (2016), Sept. 24, 2016, 4 p.m. (50 minutes).

DNS is an often-overlooked and under-tooled area of security data collection, analysis and response. We will first review existing tools and deployment choices for collecting DNS data and release the 1.0 version of my own network DNS capture tool, gopassivedns. We will then explore several example analytical approaches to large scale DNS data, including approaches to finding DNS tunneling and discovering attacker infrastructure. Finally, we take a look at how DNS can play a part in remediation and release a second tool, a RESTful interface to RPZ, goRPZ. Attendees will walk away able to implement or improve DNS collection and analysis in their environments.

Presenters:

• Philip Martin

Similar Presentations:

• NolaCon 2016 / Analyzing DNS Traffic for Malicious Activity Using Open Source Logging Tools
• NolaCon 2019 / DNS – Strategies for Reducing Data Leakage & Protecting Online Privacy
• DeepSec 2018 „I like to mov &6974,%bx“ / DNS Exfiltration and Out-of-Band Attacks