DNS, or the Domain Name System, is a critical component of the internet.
When we visit globomantics.com, a DNS request for that
domain name gets translated to an IP address.
There are millions of these requests happening all the time. When you
visit your favorite online store to shop or browse to a social media
site on your phone, there is most likely several 100 DNS requests and
responses supporting those activities.
In this clip,
I will talk about some ways Zeek data can be used to help
audit DNS in an enterprise environment.
Globomantics has one primary DNS server fulfilling requests on the network.
The admin team wants to see if Zeek can detect if a system is
configured to use a third‑party DNS server.
They also want the ability to monitor for unauthorized sub domains
as a part of their continuous monitoring program.
The first step we need to take is to gather a list of
authorized DNS servers and the associated zone data.
DNS servers are considered authoritative if they hold the original read/write
IP address mappings for a particular domain. This information will be used to
create our baseline for continuous monitoring.
Once we have the asset list,
we can use the wealth of information in the DNS log to monitor the
characteristics of the DNS requests in the environment.
We can begin to answer questions like are there any DNS
requests to nonstandard ports, and which DNS server are my
user workstations using for DNS lookups?
The connection log is great for correlating DNS
requests with subsequent connections.
Generally, a system makes a request for a domain like
www.globomantics.com, and the DNS server will respond with the IP address.
Well, in that case, there will be a connection log for the DNS request
and a connection log for the connection to the IP address of the web
server hosting the Globomantics website. I have already covered the
connection log in the rogue servers lesson, so let's look at the DNS log.
This is a sample Zeek DNS log.
I won't cover everything in this file; however,
I will go over a few noteworthy sections.
If you look at the destination port,
you can see that the default DNS port is in use; however,
remember that Zeek uses protocol analyzers to determine if the
network traffic it sees is DNS or some other protocol.
So if a covert DNS port were in use, that would be captured by this log file.
It is also important to note that there are other protocols like
Link‑Local Multicast Name resolution and NetBIOS that will show up in
the DNS logs using port 5355 and 137 respectively.
The DNS server used to facilitate the request in this
log file is the respondent host.
Any IP address listed in this field should be well known by the
admin team and documented on the asset list.
If the IP address is foreign,
then there should be some form of remediation. When it comes to
the query, there's not much value in base lining every value,
since there's an almost limitless number of domains that could
occur in this log file.
Instead,
more value can be gained by monitoring the domains and sub
domains under the control of the organization and ensuring that
the answers returned are legitimate.
Zeek allows us to capture unencrypted DNS traffic on a
network regardless of the port or protocol.
This allows us to monitor DNS queries even if they do not use the
organization's internal infrastructure. In a Windows enterprise environment,
typically the domain controller is also the DNS server,
but in hybrid environments or even at the software level,
specific DNS revolvers can be configured either incidentally or deliberately.
Some environments have technical controls in place to
redirect all DNS requests to a specific server,
but that relies on using well‑known ports.
In any case,
we would still want to know if these controlled redirects were
occurring because of a misconfiguration or potentially malicious
software trying to evade DNS logging.
DNS requests using technology such as DNS over HTTPS will not be captured
in the Zeek DNS log or even the local DNS server logs.
DNS over TLS can at least be blocked since it uses a single
port that is not often used by other software.
These technologies will make it more challenging to gain visibility
into DNS traffic as they become more prevalent.
Well, that's it for this lesson.
See you in the next clip.