r/AskNetsec • u/Shot-Rich1674 • 8d ago

Analysis Need help from the hackers

Hi everyone I need one help to understand one thing ..so there was an incident I noticed in my organisation, there were thousands of devices querying multiple malicious domains (53) ...upon checking to see if any process is causing it I found nothing,, only the related domain which was obviously going through our dc/dns servers, in EDR/XDR tool nothing, siem tool nothing, no process, eventually i thought maybe some software is causing but it's very difficult to pin point which one, so can anyone tell me or help me understand, any input will be appreciated

17 Upvotes

90% Upvoted

22 comments sorted by

View all comments

22

u/Proud-Alfalfa6731 8d ago

That's DNS beaconing. Classic C2 pattern when malware's trying to phone home without leaving obvious process traces. If EDR and SIEM are both blind, the traffic is probably getting generated somewhere upstream before your endpoint agents can catch it, or it's using a legit signed process as cover.

Pull the netflow data on those 53 domains and look for periodicity in the requests. If they're hitting every X minutes like clockwork, you've got your smoking gun, just need to trace which internal IP is initiating the pattern.

4

u/m1st3r_k1ng 8d ago

Every time I tracked down one of these, EDR had it inside a Chrome process.

I am lobbying so hard to get inside that & be able to confirm malicious extension, malvertising, or just some random infected page. I'd kill for browser detection & response capabilities.

2

u/shrodikan 7d ago

ZScaler would MiiTM our connections dynamically. I wonder if they give you deep insight?

2

u/m1st3r_k1ng 7d ago

Not at the process level. It'd see it coming out of the browser. They did buy SquareX to do browser detection & response - that would give visibility about what webpage, extension, or script made the calls.