4762 Off Label Use Of DNS
DNS is known to be one of the most widely abused protocols by
the threat actors to use in unconventional ways to hide under
normal traffic. Apart from threat actors DNS is being actively used
or rather misused by many other service providers, vendors etc. to
provide the intended services. An in depth research of the DNS logs
collected over a long period of time revealed some very interesting
legit use-cases of DNS protocol by the industry, apart from its
normal resolution service. We coined the term “Off label use of
DNS” to represent those use-cases. One of the main reasons DNS is
been used or rather misused for these off-label use-cases is the speed
of data transfer and less overhead in terms of bandwidth. These
off-label use cases of DNS leak very important information about
the clients and software they are running, and can be leveraged
in variety of ways by the network security defenders/analysts to
improve the detection on the network. This presentation will go
over some of those legit off-label use-cases and how they can be
leveraged by the analysts to detect malware trends in the network
and much more just by analyzing DNS logs.
Speaker: Fatema Bannat Wala