DNS in Enterprise IR Collection Analysis and Response

Explore DNS in enterprise incident response, collection, analysis, and response in this 47-minute conference talk from Derbycon 2016. Delve into the importance of DNS and learn about various collection tools, including resolver logging, IDSS, and standalone DNS logging. Examine analysis techniques for fast-flux, DNS exfiltration/tunneling, DGA, and low prevalence domains. Discover common false positives and gain insights into Response Policy Zones (RPZ), their benefits, and potential pitfalls. Enhance your understanding of DNS infrastructure and its role in enterprise security.

Intro
Why care about DNS?
First a note about names
Collection Tools - Resolver logging
Collection Tools - IDSS
Collection Tools - Standalone DNS logging
Infrastructure
Analysis - fast-flux
Analysis - DNS Exfiltration/Tunneling
Analysis - DGA
Analysis - Low Prevalence Domains
Analysis - Common False Positives
RPZ Explained
What is RPZ good for?
RPZ Gotchas