Unit 5: How DNS answers · Lesson 5 of 6 · 18 min
Hunting in DNS logs
Search a resolver's query log for a client generating random names and for domains nobody has asked for before.
mission
- You are
- The analyst running the weekly DNS hunt.
- Situation
- dns01 logs every query and reply. Most of it is the same few names all day. You are looking for what is different.
- Goal
- Find the client producing failed lookups and the one-off domain asked for by someone else.
- Hand in
- The noisy client, its number of failures and the rare domain with who asked for it.
One log line
- 1
Oct 14 12:15:00time - 2
query[A]a question for an IPv4 address - 3
mclwkkngkcl.example.netthe name asked for - 4
10.10.0.62the client
Count the failures
Search the log for NXDOMAIN. The counter shows how many reply lines failed.
you should see 45 failed replies in a log that otherwise answers everything.
Find who asked
Open one failed name and search for it to see the query line above it. Then search for that client's address.
you should see Every query from one client is a random-looking name, and every one fails.
defender tip Random letters, many TLDs, all failing: that is how domain generation algorithms look. The device needs isolating and checking, even though nothing resolved.
Look for the rare domain
Exclude the busy names with minus terms, for example query -corp.example -www.example.com -chat.ai -updates -NXDOMAIN -10.10.0.62.
you should see One query for a domain nobody else asked for, from an office laptop.
defender tip First-seen domains are a strong, cheap signal. Many teams alert on any domain never queried in the last 30 days.
Normal and odd
query[A] mail01.corp.example from 10.10.0.31 reply mail01.corp.example is 10.20.0.25
Short, repeated, answered.
query[A] rvltskctgsjljvxm.example.net from 10.10.0.62 reply rvltskctgsjljvxm.example.net is NXDOMAIN
Random, unique, failing, from one client.
Turn findings into rules
Write two detections: many NXDOMAIN answers from one client in a short time, and a first-seen domain that resolves. Then block the rare domain at the resolver while you investigate.
you should see Two alert rules and one blocklist entry.
What a defender takes away
- 1Resolver logs show intent: what a machine tried to reach, even when it failed.
- 2Count, then exclude the boring names. What is left is the hunt.
- 3Rare and failing names are two of the cheapest detections there are.
Questions
0 of 3 solved
Answer each one from what you find on your lab machine.