Attack Hunting with Threat Intelligence
summary
Claims that DNS logs remain the best IoC source but encryption (DoH/DoT) is reducing visibility and that simple DNS forwarder logging plus DPI sensors on TCP/UDP 53 still collects usable data. Describes extracting IoCs, detecting DNS tunneling and DGAs by combining CTI feeds (WHOIS, Infoblox/Farsight style), feature engineering and neural classifiers. States an operational result that 80% of C2 domains are DGA, and describes an expert system combining NDR and DPI with ML and a knowledge graph for profiling that raises recall and cuts analyst cost.
AI-written summary · about
chapters (20)
- 0:00Intro
- 1:30Attack (Threat) Hunting
- 2:46DNS Resolving Precedure
- 3:47Encrypted DNS: Mixed Blessing
- 6:57DNS CTI examples
- 7:33DNS as Data source of Attack Hunting
- 10:12Botnet with DGA Domain name
- 11:12DNS Tunneling
- 12:47DNS Poisoning/Spoofing
- 14:27Attack Detection with DNS at any Stage
- 15:39Entity Profiling with DNS Intelligence in Confrontation
- 17:01CTI Management Center
- 18:01DNS Security Monitoring from Logging
- 19:09CTI Distillation from DNS Logs
- 20:23DNS Subdomain Enumeration Detection
- 21:11DNS Covert Tunnel Detection
- 22:51DNS Hijacking Hunting with CTI
- 24:06DNS Spoofing Detection with Threat Intelligence
- 24:57Threat Hunting with DGA detection
- 28:48Knowledge Application and Insight Analysis Based on Knowledge Graph Technology
related talks
32mSomething’s Phishy: See the Hook Before the Bait
20mUsing Data Breadcrumbs to ID Targeted Attacks
50mTowards a Holistic Approach in Building Intelligence to Fight Crimeware
40mOODA Looping in a Turbulent World
22mTechnical Tracks
34mPractical Steps for Reducing Exposure and Detecting Compromise
47mDNS On Fire
30mThe Hunt for Major League IoT-ICS Threats: A Deep Dive into IoT Threat Terrain