Learn about how cloud-delivered DNS signatures generated
using predictive analytics and machine learning can disrupt DNS-based attacks.
Where Can I Use
What Do I Need?
DNS Security License
Advanced Threat Prevention or Threat Prevention License
As a cloud-based service, DNS Security allows you to access an
infinitely scalable DNS signature and protections source to defend
your organization from malicious domains. Domain signatures and
protections generated by Palo Alto Networks are derived from a multitude
of sources, including WildFire traffic analysis, passive DNS, active
web crawling & malicious web content analysis, URL sandbox analysis,
Honeynet, DGA reverse engineering, telemetry data, whois, the Unit
42 research organization, and third party data sources such as the Cyber
Threat Alliance. This on-demand cloud database provides users
with access to the complete Palo Alto Network’s DNS signature set,
including signatures generated using advanced analysis techniques,
as well as real-time DNS request analysis. Locally available, downloadable
DNS signature sets (packaged with the antivirus and WildFire updates)
come with a hard-coded capacity limitation of 100k signatures and
do not include signatures generated through advanced analysis. To
better accommodate the influx of new DNS signatures being produced
on a daily basis, the cloud-based signature database provides users
with instant access to newly added DNS signatures without the need
to download updates. If network connectivity goes down or is otherwise
unavailable, the firewall uses the onbox DNS signature set.
The DNS Security service operates real-time DNS
request analysis using predictive analytics and machine learning
on multiple DNS data sources. This is used to generate protections
for DNS-based threats, which are accessible in real-time through
configuration of the Anti-Spyware Security profile attached to a
Security policy rule. Each DNS threat category (the DNS Signature
Source) allows allow you to define separate policy actions as well
as a log severity level for a specific signature type. This enables
you to create specific security policies based on the nature of
the threat, according to your network security protocols. Palo Alto
Networks also generates and maintains a list of explicitly allowable
domains based on metrics from PAN-DB and Alexa. These allow list
domains are frequently accessed and known to be free of malicious
content. The DNS Security categories and the allow list are updated
and extensible through PAN-OS content releases.
PAN-OS 9.1 and earlier has a limited range of DNS Security
The DNS Security service currently supports detection of the
following DNS threat categories:
The universal threat ID number (indicated as ID in the
Threat logs) maps to a specific DNS detection mechanism used by
DNS Security to classify domains. This shows the precise categorization
of the domain, alongside the broadly defined threat category, that
it belongs to.
Command and Control Domains
—C2 includes URLs and
domains used by malware and/or compromised systems to surreptitiously
communicate with an attacker’s remote server to receive malicious
commands or exfiltrate data (this includes DNS tunneling detection
and DGA detection), or deplete resources on a target authoritative
DNS servers (such as NXNSattack).
DNS Tunnel Detection
109001001/109001002)—DNS tunneling can be used by attackers to encode
data of non-DNS programs and protocols within DNS queries and responses.
This provides attackers with an open back channel with which they can
transfer files or remotely access the system. DNS tunnel detection
uses machine learning to analyze the behavioral qualities of DNS queries,
including n-gram frequency analysis of domains, entropy, query rate,
and patterns to determine if the query is consistent with a DNS
tunneling-based attack. This includes certain next-generation DNS
tunneling malware that exfiltrates data slowly across multiple domains
to avoid detection, such as TriFive and Snugy. Combined
with the firewall’s automated policy actions, this allows you to
quickly detect C2 or data theft hidden in DNS tunnels and to automatically
block it, based on your defined policy rules.
are determined to possess DNS tunneling capabilities are further
analyzed to provide details about the tools used to embed data onto
DNS queries and responses and the associated malware campaign name
by DNS Security. The attribution details are available in the threat
logs as Threat ID/Name for the firewall and DNS Security logs on
Prisma Access as Threat Name Firewall using the following format: Tunneling:<
> or Tunneling_infil:<
> based on the specific
DNS tunnel domain type.
DGA Domain Detection
(UTID: 109000001)—Domain generation
algorithms (DGAs) are used to auto-generate domains, typically in
large numbers within the context of establishing a malicious command-and-control
(C2) communications channel. DGA-based malware (such as Pushdo,
BankPatch, and CryptoLocker) limit the number of domains from being
blocked by hiding the location of their active C2 servers within
a large number of possible suspects, and can be algorithmically
generated based on factors such as time of day, cryptographic keys,
dictionary-derived naming schemes, and other unique values. While
most domains generated by a DGA do not resolve as a valid domain,
they must all be identified to fully defend against a given threat.
DGA analysis determines whether a domain is likely to have been
generated by a machine, rather than a person, by reverse-engineering
and analyzing other frequently used techniques found in DGAs. Palo
Alto Networks then uses these characteristics to identify and block
previously unknown DGA-based threats in real-time.
(UTID: 109010007)—The NXNSAttack vulnerability
present in the DNS protocol affects all recursive DNS resolvers
and can be used by malicious actors to launch DDOS-like amplification
attacks to disrupt the normal operation of vulnerable authoritative
DNS servers. NXNSAttack can introduce massive traffic spikes on
an authoritative DNS server by forcing the recursive DNS resolver to
issue a large number of invalid requests to potentially shut down
(UTID: 109010009)—DNS rebinding attacks
lure users to an attacker-controlled domain configured with a short
TTL parameter to manipulate how domain names are resolved to exploit
and bypass the same-origin policy in browsers. This enables malicious
actors to use the client machine as an intermediary to attack or
access a resource contained within a private network.
(UTID: 109001003)—DNS infiltration
includes DNS queries that enable malicious actors to hide and resolve
minute payloads via a response to fraudulent A (IPv4) and AAAA (IPv6)
record requests. When the client resolves multiple subdomains, each
containing a A/AAAA record with an encoded component, the data contained
within them can be consolidated to form a malicious payload, which
can then be executed on the client machine. After executing the
payload, it can introduce secondary payloads to establish a DNS
tunnel or additional exploits.
Dynamic DNS Hosted Domains
(UTID: 109020002) —Dynamic
DNS (DDNS) services provide mapping between hostnames and IP addresses
in near real-time to keep changing IP addresses linked to a specific
domain, when static IPs are unavailable. This provides attackers
a method of infiltrating networks by using DDNS services to change
the IP addresses that host command-and-control servers. Malware campaigns
and exploit kits can utilize DDNS services as part of their payload
distribution strategy. By utilizing DDNS domains as part of their hostname
infrastructure, adversaries can change the IP address associated
with given DNS records and more easily avoid detection. DNS Security detects
exploitative DDNS services by filtering and cross-referencing DNS
data from various sources to generate candidate lists which are
then further validated to maximize accuracy.
—Malicious domains host and distribute
malware and can include websites that attempt to install various threats
(such as executables, scripts, viruses, drive-by downloads). Malicious
domains are distinguishable from C2 domains in that they deliver malicious
payloads into your network via an external source, whereas with
C2, infected endpoints typically attempt to connect to a remote
server to retrieve additional instructions or other malicious content.
Malware Compromised DNS
compromised DNS covers a range of techniques, some legitimate, that
result in the generation of seemingly genuine hostnames and subdomains,
which in actuality, are malicious. This includes newly observed
hostnames that mimic existing, reputable hostnames, in an attempt
to impersonate or otherwise mislead and evade database-centric security
solutions. These can be quickly produced en-masse to preempt their
addition to database lists. Domain shadowing typically follows after
an attacker gains control of a domain account through a more conventional
attack. This provides the access necessary to create illegitimate
subdomains used to coordinate attacks, even though the root domain
remains legitimate and valid, increasing the likelihood of circumventing
109003002)—Ransomware is a subcategory of malware that locks or
cryptographically prevents users from accessing data in exchange
for a ransom payment, after which the system may be released back
to the user by the attacker. Ransomware can be distributed through
malicious ransomware domains, which host the seemingly legitimate
files that users are tricked into downloading.
Newly Registered Domains
(UTID: 109020001)—Newly registered
domains are domains that have been recently added by a TLD operator
or had change in ownership within the last 32 days. While new domains
can be created for legitimate purposes, the vast majority are often
used to facilitate malicious activities, such as operating as C2
servers or used to distribute malware, spam, PUP/adware. Palo Alto Networks
detects newly registered domains by monitoring specific feeds (domain
registries and registrars) and using zone files, passive DNS, WHOIS
data to detect registration campaigns.
(UTID: 109010001) —Phishing domains
attempt to lure users into submitting sensitive data, such as personal
information or user credentials, by masquerading as legitimate websites
through phishing or pharming. These malicious activities can be
conducted through social engineering campaigns (whereby a seemingly
trusted source manipulates users into submitting personal information via
email or other forms of electronic communications) or through web
traffic redirection, which directs users to fraudulent sites that
(UTID: 109010002) —(Available with
installation of PAN-OS content release 8290 and later). Grayware domains
generally do not pose a direct security threat, however, they can
facilitate vectors of attack, produce various undesirable behaviors,
or might simply contain questionable/offensive content.These
can include websites and domains that:
trick users into granting remote access.
Leverage subdomains of popular web hosting and dynamic domain
name system (DDNS) services to host and distribute malicious content
Contain adware and other unsolicited applications (such as
cryptominers, hijackers, and PUPs [potentially unwanted programs]).
Deploy domain identification concealment actions using fast
flux techniques (
- UTID: 109010005).
Demonstrate malicious behavior and usage as evidenced through
DNS security predicative analytics (
Take advantage of user errors when entering web page addresses
Redirect traffic from a legitimate source to a malicious
website due to an improperly configured or stale DNS record on an
authoritative DNS server that has not been removed or otherwise
- UTID: 109010008).
Promote illegal activities or scams.
Include wildcard DNS entries, which can be used to evade
block lists or enable wildcard DNS attacks by routing traffic to
malicious websites (
- UTID: 109002001).
Indicate the presence of DNS traffic with anomalous characteristics
when compared to established baseline profiles built from collected
DNS data (
Have been registered months or years in advance and left in a state of dormancy to bypass
reputation checks when they become active. This also includes newly
observed domains that have never been seen or otherwise evaluated
- UTID: 109002002).
Are unused domains that have been registered by an attacker
with probable malicious intent based on certificate transparency
Stockpile Domain detection
- UTID: 109010002).
Deceive users by resembling popular brand name domains, but are instead
associated with counterfeit and fraudulent websites (
- UTID: 109002003).
(UTID: 109010003)—(Available with installation
of PAN-OS content release 8318 and later) Parked domains are typically
inactive websites that host limited content, often in the form of
click-through ads which may generate revenue for the host entity,
but generally do not contain content that is useful to the end user.
While they often function as a legitimate placeholder or as nothing
more than a benign nuisance, they could also be used as a possible
vector for distribution of malware.
Proxy Avoidance and Anonymizers
with installation of PAN-OS content release 8340 and later) Proxy
Avoidance and Anonymizers is traffic to services that are used to
bypass content filtering policies. Users who attempt to circumvent an
organization’s content filtering policies via anonymizer proxy services
are blocked at the DNS level.
Ad Tracking Domains
(UTID: 109004000)—(Available with
installation of PAN-OS content release 8586 and later) Ad Tracking
domains deliver certain types of marketing automation content for
webpages in order to track user engagement (such as link clicks,
web page navigation, etc). Typically, these third-party domains
are concealed through the use of a vanity URL to appear to be part
of the originating domain.
109004001)—CNAME cloaking provides an alternate means of concealing
a URL by modifying a web request for a subdomain to appear as if
it originates from the same website, though in actuality, the subdomain
uses a CNAME to resolve to a third-party domain. This technique
circumvents some browser-based privacy protections which could potentially
connect to a suspicious CNAME destination.