VB2016 paper: Building a local passiveDNS capability for malware incident response

Posted by   Martijn Grooten on   May 4, 2017

Anyone who has ever investigated a malware or phishing attack will know the feeling: "if only I could find out what IP address this domain pointed to when the attack took place". If you're tasked with performing incident response in your organisation, collecting passive DNS data is probably a good idea.

One way to do this is by using the free PassiveDNS Splunk app. At VB2016 in Denver, Splunk researchers and authors of the app Kathy Wang and Steve Brant presented this app, explained how it was built and how it could be used. Their paper is now available to read (HTML and PDF) on our website, and the video of their presentation is available to view on our YouTube channel.

 passive-Figure1.jpg

 

If you're interested in what can be done with such data, make sure you come to VB2017 and watch OpenDNS researchers Dhia Mahjoub and David Rodriguez present their paper "Beyond lexical and PDNS: using signals on graphs to uncover online threats at scale".

VB2017 will take place in Madrid, 4-6 October 2017. Register now for an Early Bird discount!

 

twitter.png
fb.png
linkedin.png
googleplus.png
reddit.png

 

Latest posts:

WannaCry shows we need to understand why organizations don't patch

Perhaps the question we should be asking about WannaCry is not "why do so many organizations allow unpatched machines to exist on their networks?" but "why doesn't patching work reasonably well most of the time?"

Modern security software is not necessarily powerless against threats like WannaCry

The WannaCry ransomware has affected many organisations around the world, making it probably the worst and most damaging of its kind. But modern security is not necessarily powerless against such threats.

Throwback Thursday: CARO: A personal view

This week sees the 11th International CARO Workshop taking place in Krakow, Poland – a prestigious annual meeting of anti-malware and security experts. As a founding member of CARO, Fridrik Skulason was well placed, in August 1994, to shed some light…

VB2016 paper: Uncovering the secrets of malvertising

Malicious advertising, a.k.a. malvertising, has evolved tremendously over the past few years to take a central place in some of today’s largest web-based attacks. It is by far the tool of choice for attackers to reach the masses but also to target…

Throwback Thursday: Tools of the DDoS Trade

As DDoS attacks become costlier to fix and continue to increase in both number and diversity, we turn back the clock to 2000, when Aleksander Czarnowski took a look at the DDoS tools of the day.