Question

Which DNS servers are in use and have been used in the past? 

Discover → DNS Compliance → Interesting Insights “Top DNS Servers”

Where are the DNS servers in use located and are any of them associated with malicious activity?

Discover → DNS Compliance → Interesting Insights “Top DNS Servers” → Click on VirusTotal link associated

What are the rarely used DNS servers and who is using them?

Discover → DNS Compliance → Interesting Insights

“Rare DNS Servers”

Image Modified

Are there long DNS queries being generated which could be possible DGA or exfiltration?

Discover → DNS Compliance → Filter by query_length:>30 Tweak the threshold as appropriate or filter by other criteria (such as query_domain).

Discover → DNS Compliance → Sort all queries by the query length column.

Image Modified

Who are the top querying nodes over DNS? (could be a sign of exfiltration)

Discover → DNS Compliance → Interesting Insights “Top Querying Clients”

Image Modified

What are the rarest domains being queried? (could be a sign of C2)

Discover → DNS Compliance → Interesting Insights “Least Queried Domains”

Which endpoints have the most DNS errors? (could be a sign of DGA activity)

Image Modified

Discover → DNS Compliance → Interesting Insights “Top Clients with DNS Errors”

Image Modified

Are outdated and vulnerable TLS versions in use in the network such as TLS 1.0? Are there SSL transactions in the network?

Discover → TLS Compliance → Interesting Insights “Outdated Versions”

Image Modified

Are there unusual protocols traversing the N-S interface such as RPC, SMB or RDP?

Is there RPC activity from external hosts to server IPs?

Discover → RPC→ Query -orig_h:"192.168.0.0/16" OR -orig_h:"10.0.0.0/8" OR -orig_h:"172.16.0.0/12"

Discover → SMB Mapping → Query -orig_h:"192.168.0.0/16" OR -orig_h:"10.0.0.0/8" OR -orig_h:"172.16.0.0/12"

Discover → RDP → Query -orig_h:"192.168.0.0/16" OR -orig_h:"10.0.0.0/8" OR -orig_h:"172.16.0.0/12"

Image Modified

Are standard protocols being used over non-standard ports?

Suspicious Objects → Interesting Insights “Standard protocols over non-standard ports”

Image Modified

Is there traffic, to/from the server farm that does not belong? - e.g. SSH,TLS using a certificate issued by an rare CA. 

Image Modified

What kinds of files are being downloaded by servers? How many of such files are from external hosts?

Suspicious Objects → Query _exists_:resp_h AND (-resp_h:"192.168.0.0/16" OR -resp_h:"10.0.0.0/8" OR -resp_h:"172.16.0.0/12")

Are there outgoing compressed files? How much data is being transferred outside in that manner?

Suspicious Objects → Interesting Insight “Outgoing Compressed Files”

Are there files being transferred over SMB where the file type does not match the file name?

Suspicious Objects → Query filetype:exe AND !filename: *exe*

Questions

Are any endpoints performing recon activities?

Security Findings → Port Scan

Security Findings -> Address_Scan

Are administrative tasks occurring from the non-admin subnets?

If admin subnet is 192.168.0.0/16 then

Discover → RPC Tab and SMB Mapping Tab → Query orig_h:"192.168.0.0/16"

Are users connecting to suspicious shares?

Discover → SMB Mapping → Suspicious SMB Shares

Which hosts (whether inside or outside) communicate with servers most often? What communication is happening at unusual times?

Discover → Connection Analytics → Top Uploaders/Downloaders

Are there files being transferred over SMB where the file type does not match the file name?

Discover → SMB Files → Query filetype:exe AND !filename: *exe*

Which hosts are attempting to discover SMB shares?

Discover→ SMB Mapping

Which hosts are attempting to make multiple attempts at lateral movement?

Security Findings → Lateral Movement Detected

Was any host targeted with lateral movement and execution?

Security Findings → Lateral Movement and Execution

Questions

Are hosts connecting to Cobalt Strike Team Server controller ports?

Discover → Connection Outliers → Query conn_dst_port_list:"50050/tcp"

Are hosts using uncommon HTTP comms?

Discover → HTTP → Query !resp_p:80 AND !resp_p:443 AND method:POST

Are hosts using uncommon DNS comms with exfil or tunnel characteristics?

Discover → HTTP → Query query_length:>100 AND answers:"TXT*"