4 ms·
I’ve never seen anyone try and setup alerts for random DNS queries. If you’re in the position to know what domains are good, then why not simply use a whitelist
by 3fe9a03ccd14ca5 7y ago
I’ve never seen anyone try and setup alerts for random DNS queries. If you’re in the position to know what domains are good, then why not simply use a whitelist?
Besides, even if you saw these queries you’d have no easy way of know I’d they were malicious or not.
- LIV2 7y agoSome IDS systems do it for you I was using Darktrace at my last job and it would tell us when servers started querying domains they don't usually query so there are products that do it
- 3fe9a03ccd14ca5 7y agoThose systems usually flag based on a known set of “bad” domains, which wouldn’t stop this attack (they could just register a few new domains before starting the attack).