SANSFIRE 2022 Bonus Session - DNS Data Driven Threat Hunting with DomainTools

Thursday, 14 Jul 2022 12:30PM EDT (14 Jul 2022 16:30 UTC)
Speaker: Taylor Wilkes-Pierce

When adversaries register malicious domains for C2 servers, phishing servers, or payload servers, the choices they make when it comes to registration, hosting, certificates, mail servers and more can be useful in determining their targets and discovering a fuller picture of their operations in DNS.

This can help defenders by increasing the speed at which they can assess and act on this activity. In this session attendees will learn how to use DomainTools to:

Identify attacks while they are still in the setup stage
Take a single element, like a domain name, and pivot on it to discover a broader map of adversary infrastructure
Monitor for new activity matching adversary patterns in DNS

Login to Register

Sponsor

Related Content

blog image - ransomware summit.png

Digital Forensics, Incident Response & Threat Hunting

A Visual Summary of SANS Ransomware Summit 2024

Check out these graphic recordings created in real-time throughout the event for SANS Ransomware Summit 2024

DFIR - Blog - The Evolution of Enterprise Threat Hunting- Detailed Insights from the SANS 2024_340 x 340.jpg

Digital Forensics, Incident Response & Threat Hunting

The Evolution of Enterprise Threat Hunting: Detailed Insights from the SANS 2024 Survey

The SANS Survey highlights threat hunting's evolution with increased formalization and strategic integration to enhance cybersecurity effectiveness.

DFIR_ICON_(1).PNG

CTI_Blog_part_1_(1).png

Digital Forensics, Incident Response & Threat Hunting

January 12, 2024

Helping CTI Analysts Approach and Report on Emerging Technology Threats and Trends (Part 2)

How to approach, research, and develop analytic assessments on emerging technologies and threat trends (Part 2)