SANS@MIC -Threat Hunting via DNS

  • Wednesday, 24 Jun 2020 3:30PM EDT (24 Jun 2020 19:30 UTC)
  • Speaker: Eric Conrad

DNS logs are one of the most powerful threat hunting resources, but encryption is rapidly changing that equation.

Key DNS threat hunting techniques include detecting DNS tunneling and Domain Generation Algorithms (DGAs). It used to be simple(r): log DNS requests and responses on DNS forwarders, or sniff and analyze via tools like Zeek.

DNS over TLS (DoT) and DNS over HTTPS (DoH) are disrupting the status quo: where does that leave network defenders? This talk will analyze the current state of DNS monitoring, and provide actionable steps for detecting malice on your network via DNS.