Cloud-Delivered DNS Signatures and Protections

• Command and Control Domains—C2 includes URLs and domains used by malware and/or compromised systems to surreptitiously communicate with an attacker’s remote server to receive malicious commands or exfiltrate data (this includes DNS tunneling detection and DGA detection), or deplete resources on a target authoritative DNS servers (such as NXNSattack).
  • DNS Tunnel Detection (UTID: 109001001/109001002)—DNS tunneling can be used by attackers to encode data of non-DNS programs and protocols within DNS queries and responses. This provides attackers with an open back channel with which they can transfer files or remotely access the system. DNS tunnel detection uses machine learning to analyze the behavioral qualities of DNS queries, including n-gram frequency analysis of domains, entropy, query rate, and patterns to determine if the query is consistent with a DNS tunneling-based attack. This includes certain next-generation DNS tunneling malware that exfiltrates data slowly across multiple domains to avoid detection, such as TriFive and Snugy. Combined with the firewall’s automated policy actions, this allows you to quickly detect C2 or data theft hidden in DNS tunnels and to automatically block it, based on your defined policy rules.
    Domains that are determined to possess DNS tunneling capabilities are further analyzed to provide details about the tools used to embed data onto DNS queries and responses and the associated malware campaign name by DNS Security. The attribution details are available in the threat logs as Threat ID/Name for the firewall and DNS Security logs on Prisma Access as Threat Name Firewall using the following format: Tunneling:<optional_list_of_tools/campaigns; dot-separated string)>:<domain_name> or Tunneling_infil:<optional_list_of_tools/campaigns; dot-separated string)>:<domain_name> based on the specific DNS tunnel domain type.
  • DGA Domain Detection (UTID: 109000001)—Domain generation algorithms (DGAs) are used to auto-generate domains, typically in large numbers within the context of establishing a malicious command-and-control (C2) communications channel. DGA-based malware (such as Pushdo, BankPatch, and CryptoLocker) limit the number of domains from being blocked by hiding the location of their active C2 servers within a large number of possible suspects, and can be algorithmically generated based on factors such as time of day, cryptographic keys, dictionary-derived naming schemes, and other unique values. While most domains generated by a DGA do not resolve as a valid domain, they must all be identified to fully defend against a given threat. DGA analysis determines whether a domain is likely to have been generated by a machine, rather than a person, by reverse-engineering and analyzing other frequently used techniques found in DGAs. Palo Alto Networks then uses these characteristics to identify and block previously unknown DGA-based threats in real-time.
  • NXNSAttack (UTID: 109010007)—The NXNSAttack vulnerability present in the DNS protocol affects all recursive DNS resolvers and can be used by malicious actors to launch DDOS-like amplification attacks to disrupt the normal operation of vulnerable authoritative DNS servers. NXNSAttack can introduce massive traffic spikes on an authoritative DNS server by forcing the recursive DNS resolver to issue a large number of invalid requests to potentially shut down the server.
  • DNS Rebinding (UTID: 109010009)—DNS rebinding attacks lure users to an attacker-controlled domain configured with a short TTL parameter to manipulate how domain names are resolved to exploit and bypass the same-origin policy in browsers. This enables malicious actors to use the client machine as an intermediary to attack or access a resource contained within a private network.
  • DNS Infiltration (UTID: 109001003)—DNS infiltration includes DNS queries that enable malicious actors to hide and resolve minute payloads via a response to fraudulent A (IPv4) and AAAA (IPv6) record requests. When the client resolves multiple subdomains, each containing a A/AAAA record with an encoded component, the data contained within them can be consolidated to form a malicious payload, which can then be executed on the client machine. After executing the payload, it can introduce secondary payloads to establish a DNS tunnel or additional exploits.
  • DNS Traffic Profiling (UTID: 109010010)—(Requires Advanced DNS Security) DNS traffic profiling is a cloud-based analyzer that detects malware attempting to establish a C2 connection, based on an assessment of DNS traffic patterns. As Advanced DNS Security monitors your organization's DNS traffic, the outbound DNS request sequences are vectorized to form DNS traffic profiles, which are then analyzed using ML techniques that can associate the unique DNS request patterns with identifiable malicious C2 domain profiles.
• Dynamic DNS Hosted Domains (UTID: 109020002) —Dynamic DNS (DDNS) services provide mapping between hostnames and IP addresses in near real-time to keep changing IP addresses linked to a specific domain, when static IPs are unavailable. This provides attackers a method of infiltrating networks by using DDNS services to change the IP addresses that host command-and-control servers. Malware campaigns and exploit kits can utilize DDNS services as part of their payload distribution strategy. By utilizing DDNS domains as part of their hostname infrastructure, adversaries can change the IP address associated with given DNS records and more easily avoid detection. DNS Security detects exploitative DDNS services by filtering and cross-referencing DNS data from various sources to generate candidate lists which are then further validated to maximize accuracy.
• Malware Domains —Malicious domains host and distribute malware and can include websites that attempt to install various threats (such as executables, scripts, viruses, drive-by downloads). Malicious domains are distinguishable from C2 domains in that they deliver malicious payloads into your network via an external source, whereas with C2, infected endpoints typically attempt to connect to a remote server to retrieve additional instructions or other malicious content.
  • Malware Compromised DNS (UTID: 109003001)—Malware compromised DNS covers a range of techniques, some legitimate, that result in the generation of seemingly genuine hostnames and subdomains, which in actuality, are malicious. This includes newly observed hostnames that mimic existing, reputable hostnames, in an attempt to impersonate or otherwise mislead and evade database-centric security solutions. These can be quickly produced en-masse to preempt their addition to database lists. Domain shadowing typically follows after an attacker gains control of a domain account through a more conventional attack. This provides the access necessary to create illegitimate subdomains used to coordinate attacks, even though the root domain remains legitimate and valid, increasing the likelihood of circumventing network security.
  • Ransomware Domains (UTID: 109003002)—Ransomware is a subcategory of malware that locks or cryptographically prevents users from accessing data in exchange for a ransom payment, after which the system may be released back to the user by the attacker. Ransomware can be distributed through malicious ransomware domains, which host the seemingly legitimate files that users are tricked into downloading.
• Newly Registered Domains (UTID: 109020001)—Newly registered domains are domains that have been recently added by a TLD operator or had change in ownership within the last 32 days. While new domains can be created for legitimate purposes, the vast majority are often used to facilitate malicious activities, such as operating as C2 servers or used to distribute malware, spam, PUP/adware. Palo Alto Networks detects newly registered domains by monitoring specific feeds (domain registries and registrars) and using zone files, passive DNS, WHOIS data to detect registration campaigns.
• Phishing Domains (UTID: 109010001) —Phishing domains attempt to lure users into submitting sensitive data, such as personal information or user credentials, by masquerading as legitimate websites through phishing or pharming. These malicious activities can be conducted through social engineering campaigns (whereby a seemingly trusted source manipulates users into submitting personal information via email or other forms of electronic communications) or through web traffic redirection, which directs users to fraudulent sites that appear legitimate.
• Grayware Domains (UTID: 109010002) —(Available with installation of PAN-OS content release 8290 and later). Grayware domains generally do not pose a direct security threat, however, they can facilitate vectors of attack, produce various undesirable behaviors, or might simply contain questionable/offensive content.These can include websites and domains that:
  • Attempt to trick users into granting remote access.
  • Leverage subdomains of popular web hosting and dynamic domain name system (DDNS) services to host and distribute malicious content (subdomain reputation - UTIDL 109002004).
  • Contain adware and other unsolicited applications (such as cryptominers, hijackers, and PUPs [potentially unwanted programs]).
  • Deploy domain identification concealment actions using fast flux techniques (fastflux detection - UTID: 109010005).
  • Demonstrate malicious behavior and usage as evidenced through DNS security predicative analytics (malicious NRD - UTID: 109010006).
  • Redirect traffic from a legitimate source to a malicious website due to an improperly configured or stale DNS record on an authoritative DNS server that has not been removed or otherwise corrected (dangling DNS - UTID: 109010008).
  • Promote illegal activities or scams.
  • Include wildcard DNS entries, which can be used to evade block lists or enable wildcard DNS attacks by routing traffic to malicious websites (Wildcard abuse - UTID: 109002001).
  • Indicate the presence of DNS traffic with anomalous characteristics when compared to established baseline profiles built from collected DNS data (Anomaly detection).
  • Have been registered months or years in advance and left in a state of dormancy to bypass reputation checks when they become active. This also includes newly observed domains that have never been seen or otherwise evaluated (Strategically-aged domains - UTID: 109002002).
  • Are unused domains that have been registered by an attacker with probable malicious intent based on certificate transparency logs (Stockpile Domain detection - UTID: 109002005).
  • Deceive users by resembling popular brand name domains as well as incorrectly entered web page addresses, with the goal of directing users to counterfeit and fraudulent websites. (Cybersquatting / Typosquatting domains - UTID: 109002003).
• Parked Domains (UTID: 109010003)—(Available with installation of PAN-OS content release 8318 and later) Parked domains are typically inactive websites that host limited content, often in the form of click-through ads which may generate revenue for the host entity, but generally do not contain content that is useful to the end user. While they often function as a legitimate placeholder or as nothing more than a benign nuisance, they could also be used as a possible vector for distribution of malware.
• Proxy Avoidance and Anonymizers (UTID: 109010004)—(Available with installation of PAN-OS content release 8340 and later) Proxy Avoidance and Anonymizers is traffic to services that are used to bypass content filtering policies. Users who attempt to circumvent an organization’s content filtering policies via anonymizer proxy services are blocked at the DNS level.
• Ad Tracking Domains (UTID: 109004000)—(Available with installation of PAN-OS content release 8586 and later) Ad Tracking domains deliver certain types of marketing automation content for webpages in order to track user engagement (such as link clicks, web page navigation, etc). Typically, these third-party domains are concealed through the use of a vanity URL to appear to be part of the originating domain.
  • CNAME Cloaking (UTID: 109004001)—CNAME cloaking provides an alternate means of concealing a URL by modifying a web request for a subdomain to appear as if it originates from the same website, though in actuality, the subdomain uses a CNAME to resolve to a third-party domain. This technique circumvents some browser-based privacy protections which could potentially connect to a suspicious CNAME destination.
• Hijacked Domains (UTID: 109004000)—(Requires Advanced DNS Security) Hijacked domains include domains where attackers gain the ability to make legitimate domains resolve to attacker-operated IP addresses, typically, by compromising some aspect of an organization's DNS infrastructure. This can include the unauthorized administrative access to the DNS provider, an MiTM attack during the DNS resolution process, or the access to the DNS server itself.
• Misconfiguration Domains (UTID: 109004000)—(Requires Advanced DNS Security) Misconfigured domains enable attackers to incorporate their own malicious domains into an organization's DNS by taking advantage of domain configuration issues. These outdated DNS records allow attackers to take ownership of the customer’s subdomain and redirect users to attacker-controlled IPs or websites for malicious purposes. These non-resolvable misconfiguration domains are based on the public-facing parent domain(s) that are specified during configuration of Advanced DNS Security.
  • Misconfiguration Zone: (UTID: 109004200)—A generic category for misconfiguration domains that do not correspond to any other misconfiguration category.
  • Misconfiguration Zone Dangling (UTID: 109004201)—Misconfigured domains that redirect traffic from a legitimate source to a malicious website due to an improperly configured or stale DNS record on an authoritative DNS server present in an organization's public-facing domain.
  • Misconfiguration Claimable NX (UTID: 109004202)—Misconfigured domains that are defined as part of an organization’s DNS configuration, but no longer exist (NXDOMAINS), can be surreptitiously registered by attackers and be used to redirect users to malicious websites and potentially allows the attacker to gain access to a customer’s network.