深入理解实践场景下的DNS隧道通信( 二 ) _DNS

bram.ciscocloud[.]space
34.92.43[.]140
ubrella[.]online
8.d4fee8aa63e4ee6435452f86e84464168e96e314eb1a19c45e0e76f3ca71b2a.e9476062765ba0aeaeea97333805f09470ff3bd103e3ce8bd3ffefa3dfea90f.369cd352a204e9662db180407f1d1b8fa87be97c81d1.feign.ubrella[.]online
rumor.ubrella[.]online
34.92.43[.]140
mscd[.]store
4.a6gpmbnqbjewgwnqnlivwhleux4vnnyiuduyqgjkyn9jcihsttpdbdenf7lx8jx.jqhdulrejthsyipzvoleyvhv5s99nydtj5um8bzdmdms9gwdqnq46yis5hvbryo.dernuvjw7a6p6ndq4c8lwomsl7zq5lncgsutndxfpaufefhr7xxeuhfpk8hs.sny7htmpdpqdcumtgrmeptytbe9p78skry64.17328.fish.mscd[.]store
rug.mscd[.]store
35.194.255[.]111
awsl[.]site
1.758fcd0ac2301084ef82efb047050ff5e7d45b4cd636b46e4292b67acac5ab0.a1644dfde400b8d41e7b6ec37338c45d34a8e9ed81173e8dffdf57ebb3c9e30.9fc12877d608dfca610d50a121acbd30b2450391c13a.mud.awsl[.]site
lkas.awsl[.]site
35.194.255[.]111
msft[.]center
10.c5f310abb43603a3af324ee92bea16c8132ec2909fbca8d1036fe409d33af9b.c8c30e936bffb9f93bcba2c27682dcca1ab79aced6d1cf015a11d56a9c2f9f5.c49d8757a19b693d78d1772977cbf164e2748b57bb9f.ud.msft[.]center
08e099da.msft[.]center
34.81.65[.]4
我们的第二个例子是针对另一个金融行业客户的活动，我们发现三个隧道域名都指向着同一客户，并且使用了相同的底层隧道工具-Cobalt Strike ，而Cobalt Strike的代表性特征包括使用常见前缀，例如www、post和api等。
这三个域名分别为identity-mgmt[.]com、internalsupport[.]info和cloud-enrollment[.]com，下面给出的是对应的查询样例、域名服务器和IP地址：
域名
查询样例
域名服务器
域名服务器IP
cloud-enrollment[.]com
api.12abc2cb5.446f35fa.dns.cloud-enrollment[.]com
ns1.cloud-enrollment[.]com
3.238.113[.]212
identity-mgmt[.]com
intact.md.180.02d8f18d2.7e8986be.int.identity-mgmt[.]com
ns1.cloud-enrollment[.]com
3.238.113[.]212
internalsupport[.]info
icr.0325e18d8.16ae9fb2.pl.internalsupport[.]info
dn.internalsupport[.]info
3.238.244[.]129
总结现在，越来越多的网络团伙会将DNS隧道通信技术应用到各种各样的地方，包括C2服务器和V*N服务等等。因此，作为安全防御端人员来说，了解DNS隧道技术的在野利用情况就非常重要了，只有了解了DNS隧道通信的底层工具和相关活动，才能实现细粒度分析，从而做到安全事件的快速响应。
入侵威胁指标IoC域名

panos[.]ltd
ciscocloud[.]space
ubrella[.]online
mscd[.]store
awsl[.]site
msft[.]center
cloud-enrollment[.]com
identity-mgmt[.]com
internalsupport[.]info
claudfront[..NET
allowlisted[.]net
hsdps[.]cc
rcsmf100[.]net
hammercdntech[.]com

IP地址

34.92.43[.]140
35.194.255[.]111
34.81.65[.]4
3.238.113[.]212
3.238.244[.]129
5.252.176[.]63
83.166.240[.]52
5.252.176[.]22
194.31.55[.]85
65.20.73[.]176

其他参考资料

https://unit42.paloaltonetworks.com/tag/dns-tunneling/
https://unit42.paloaltonetworks.com/solarstorm-supply-chain-attack-timeline/
https://unit42.paloaltonetworks.com/dns-tunneling-how-dns-can-be-abused-by-malicious-actors/
https://www.bamsoftware.com/software/dnstt/
https://blogs.infoblox.com/cyber-threat-intelligence/cyber-threat-advisory/dog-hunt-finding-decoy-dog-toolkit-via-anomalous-dns-traffic/
https://unit42.paloaltonetworks.com/dns-tunneling-in-the-wild-overview-of-oilrigs-dns-tunneling/
https://unit42.paloaltonetworks.com/oilrig-novel-c2-channel-steganography/

参考来源