Advanced DNS Security now supports Dangling Web And App Domain Detection to combat a rising threat in enterprise environments.

Websites often rely on links to external third-party resources. When these external domains expire, they become dangling assets that threat actors can quickly re-register to host malicious payloads. This tactic allows attackers to serve malware or execute cross-site scripting (XSS) attacks through what appear to be legitimate, trusted business sites.

To neutralize this risk, the Advanced DNS Security and Advanced DNS Security Resolver services now proactively identify and block DNS requests directed at these expired, high-risk domains. By intercepting the threat at the DNS resolution layer, the system ensures a secure perimeter is maintained before a network connection can ever be established.

The DNS Security Resolver now provides access to a new domain category for content-based DNS signature sources: file-converter.

These sites were previously grouped generically under Computer and Internet Info, but now, you can now apply a discrete policy action for the file-converter domain category, allowing you to block a more specific range of websites.

The DNS Security DNS tunnel detector can now minimize data leakage by evaluating individual DNS queries in real-time, enabling it to identify malicious tunneling activity from the very first query to the last.

Additional configuration is not required if you have already enabled DNS Security and defined a policy action for Command and Control Domains, which is the parent category for the existing DNS Tunnel Detection DNS threat category.

For more information about the DNS tunnel detector enhancements, refer to: Closing the Gap in DNS Security: Palo Alto Networks' Innovative Approach to Immediate Tunneling Detection.