VB2016 paper: Building a local passiveDNS capability for malware incident response

Posted by   Martijn Grooten on   May 4, 2017

Anyone who has ever investigated a malware or phishing attack will know the feeling: "if only I could find out what IP address this domain pointed to when the attack took place". If you're tasked with performing incident response in your organisation, collecting passive DNS data is probably a good idea.

One way to do this is by using the free PassiveDNS Splunk app. At VB2016 in Denver, Splunk researchers and authors of the app Kathy Wang and Steve Brant presented this app, explained how it was built and how it could be used. Their paper is now available to read (HTML and PDF) on our website, and the video of their presentation is available to view on our YouTube channel.



If you're interested in what can be done with such data, make sure you come to VB2017 and watch OpenDNS researchers Dhia Mahjoub and David Rodriguez present their paper "Beyond lexical and PDNS: using signals on graphs to uncover online threats at scale".

VB2017 will take place in Madrid, 4-6 October 2017. Register now for an Early Bird discount!




Latest posts:

VB2017 paper: The life story of an IPT - Inept Persistent Threat actor

At VB2017 in Madrid, Polish security researcher and journalist Adam Haertlé presented a paper about a very inept persistent threat. Today, we publish both the paper and the recording of Adam's presentation.

Five reasons to submit a VB2018 paper this weekend

The call for papers for VB2018 closes on 18 March, and while we've already received many great submissions, we still want more! Here are five reasons why you should submit a paper this weekend.

First partners of VB2018 announced

We are excited to announce the first six companies to partner with VB2018.

VB2018: looking for technical and non-technical talks

We like to pick good, solid technical talks for the VB conference programme, but good talks don't have to be technical and we welcome less technical submissions just as much.

Partner with VB2018 for extra visibility among industry peers

Partnering with the VB conference links your company to a successful and well-established event, demonstrates your commitment to moving the industry forward, allows you to meet potential clients, be visible to industry peers and build lasting…