...
Question |
Which DNS servers are in use and have been used in the past?Discover → DNS Compliance → Interesting Insights “Top DNS Servers” Where are the DNS servers in use located and are any of them associated with malicious activity?Discover → DNS Compliance → Interesting Insights “Top DNS Servers” → Click on VirusTotal link associated What are the rarely used DNS servers and who is using them?Discover → DNS Compliance → Interesting Insights “Top DNS Servers” → choose 50 on bottom left tab → look at servers listed on bottom Are there long DNS queries being generated which could be possible DGA or exfiltration?Discover → DNS Compliance → Sort all queries by the query length column. Who are the top querying nodes over DNS? (could be a sign of exfiltration)Discover → DNS Compliance → Interesting Insights “Top Querying Clients” What are the rarest domains being queried? (could be a sign of C2)Discover → DNS Compliance → Interesting Insights “Least Queried Domains” Which endpoints have the most DNS errors? (could be a sign of DGA activity)Discover → DNS Compliance → Interesting Insights “Top Clients with DNS Errors” |
Are outdated and vulnerable TLS versions in use in the network such as TLS 1.0? Are there SSL transactions in the network?Discover → TLS Compliance → Interesting Insights “Outdated Versions”  |
Are there unusual protocols traversing the N-S interface such as RPC, SMB or RDP? Is there RPC activity from external hosts to server IPs?Discover → RPC→ Query <-orig_h:"192.168.0.0/16" OR -orig_h:"10.0.0.0/8" OR -orig_h:"172.16.0.0/12"> Discover → SMB Mapping → Query <-orig_h:"192.168.0.0/16" OR -orig_h:"10.0.0.0/8" OR -orig_h:"172.16.0.0/12"> Discover → RDP → Query <-orig_h:"192.168.0.0/16" OR -orig_h:"10.0.0.0/8" OR -orig_h:"172.16.0.0/12">  |
Are standard protocols being used over non-standard ports?Suspicious Objects → Interesting Insights “Standard protocols over non-standard ports”  |
Is there traffic, to/from the server farm that does not belong? - e.g. SSH,TLS using a certificate issued by an rare CA. |
What kinds of files are being downloaded by servers? How many of such files are from external hosts?Suspicious Objects → Query <_exists_:resp_h AND (-resp_h:"192.168.0.0/16" OR -resp_h:"10.0.0.0/8" OR -resp_h:"172.16.0.0/12")> |
Are there outgoing compressed files? How much data is being transferred outside in that manner?Suspicious Objects → Interesting Insight “Outgoing Compressed Files” |
Are there files being transferred over SMB where the file type does not match the file name?Suspicious Objects → Query “protocol:smb AND filetype“filetype: exe AND !filename: *exe*” |
...