Noticing command and control channels by reviewing DNS protocols, (Mon, Nov 13th)

Malicious software pieces installed in computers call home. Some of them can be noticed because they perform DNS lookup and some of them initiates connection without DNS lookup. For this last option, this is abnormal and can be noticed by any Network Detection and Response (NDR) tool that reviews the network traffic by at least two weeks.

Article Link: https://isc.sans.edu/diary/rss/30396

1 post - 1 participant

Read full topic

call command command and control computers control detection detection and response dns home malicious malicious software ndr network network detection network detection and response nov protocols response software tool