Rustock used DNS for bots to connect to its command infrastructure.
Explicit Confidence 98% · Jack Rhysider EP 110 Details
“The botnet used DNS for the bots to connect to.”
Protocol
protocol:dns
Also: DNS queries, DNS registrars, DNS server, Domain Name System
Naming system that translates domains such as google.com into IP addresses.
Naming system that translates domains such as google.com into IP addresses.
“A DNS server translates a domain like google.com to an IP address”
Name-resolution protocol discussed as part of how Responder intercepts failed local name lookups.
“That’s what DNS is for.”
Domain Name System used to resolve domain names to IP addresses and, in the episode, to block access to The Pirate Bay.
“they forced the internet providers to block Pirate Bay and DNS”
“a DNS is how URLs get resolved to IP addresses”
Name-resolution protocol and infrastructure used in the episode to observe botnet command-and-control activity.
“we review the authoritative main server traffic”
“every one minute and thirty seconds to the second when the cache expires”
Networking technology Marq learned while developing his technical skills.
“he learned more about Windows, DNS, IP addresses”
Name-resolution protocol used by Rustock bots to connect to command-and-control infrastructure.
“The botnet used DNS for the bots to connect to.”
Naming and resolution system used in the described subdomain discovery process.
“you can check to see if admin.bank.com exists with the DNS registrars”
Name-resolution system whose queries were collected and analyzed to identify connections to suspicious or malicious domains.
“a tool to analyze all the DNS queries that the organization made”
Name-resolution service used in the described sequence for locating a shared-drive host.
“It might ask the DNS server”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| incoming | USES | Rustock | Explicit | 110 |
| incoming | USES | Dominican Republic National CSIRT | Explicit | 135 |
Rustock used DNS for bots to connect to its command infrastructure.
Explicit Confidence 98% · Jack Rhysider EP 110 Details
“The botnet used DNS for the bots to connect to.”
Dominican Republic National CSIRT USES DNS
The Dominican Republic CSIRT implemented a tool to analyze DNS queries across government organizations for visibility into network activity.
Explicit Confidence 98% · Omar Avilez EP 135 Details
“we got a tool to analyze all the DNS queries that the organization made”