Penetration Testing

Domain Investigations Using Open-Source Tools And DomainTools Iris

This blog post is sponsored by DomainTools. For more information and product trials please visit https://securityweekly.com/domaintools

Malicious or Not?

The above question runs through the brains of SOC analysts across the world multiple times per day. When you are analyzing security events looking for the “bad” things, you often come across a domain that requires investigation. Domains are an integral part of a security investigation as a whole as they can appear in malware samples, malicious JavaScript, several different types of logs, and of course directly from your network (via a SPAN port) or directly from your DNS servers if you are logging all queries. If you are not analyzing all of your DNS queries, you should be as a domain can be a reliable indicator of malicious activity. While there are several tools and techniques available to gather information about a domain, DomainTools has consolidated this information, making it easy to pivot and investigate domains using Iris. I had a chance to use Iris to investigate some domains, and was very impressed. My methodology from start to finish is outlined below.

Collecting Domain Data

My setup is fairly traditional as I use a network SPAN port along with The Security Onion to collect data about my network for security analysis. I used a Cisco switch with the following commands to setup the SPAN port:

monitor session 1 source vlan 172
monitor session 1 destination interface Gi0/39 encapsulation replicate

By default, the first command will monitor traffic in both directions on the specified VLAN. We then send the monitor session traffic to port Gi0/39, using the encapsulation method as the source interface, giving us BPDU and Layer 2 traffic as well (Further reading)

I setup the Security Onion on an Ubuntu server. Documentation for this setup can be found over at the Security Onion Website.

Additional Modules – Baby Domains

I installed the DomainStats add-on, written by Mark Bagget and implemented in Docker by Justin Henderson, Security Onion, using DomainStats, will report on domain age, listing domains that are younger than 60 days. New domains can be suspect as C2 channels will often register new domains for communication.

https://github.com/SMAPPER/docker_domain_stats

https://github.com/Security-Onion-Solutions/security-onion/wiki/DomainStats

Baby Domains - The Security Onion
A list of baby domains in the Security Onion Kibana interface.

Parsing Query Logs

By default Bro, as part of the Security Onion, will beging to log all of the DNS queries observed on the network. It stores them in /nsm/bro/logs/current (and archives older logs into separate directories by date). I use the following command to save all of the queried domains to a file:

$ zcat dns.* | jq .query | uniq -c | sort -n | 
uniq | egrep -v '(.com|.net|.org|.edu)' > ~/domain.list

The “jq query” command is a newer addition to the Security Onion and will parse the JSON output and return just the domain names in the logs. Next we use basic Bash commands to get a unique list and remove common top-level domains. This was an approach I used to pair down the list into the domains that may be more interesting. I then searched through the results for specific top-level domains. Using the following commands I reviewed the domains from China and Russia as I thought that might be a good start:

$ egrep -v '(in-addr.|psw.io|.local|.io)' domain.list | grep ".ru"

$ egrep -v '(in-addr.|psw.io|.local|.io)' domain.list | grep ".cn"

As it turns out, one of the domains from Russia was identified by DomainTools Iris as being “bad”, earning a score of 100:

Screenshot 2019-03-15 12.38.13.png

You can also see the list of other domains that are associated with ns.parens.ru. While most also earn a score of 100, there is a shorter list of domains that have a lower score, but are likely malicious by association. Their score is lower because they likely have not yet been used in an active command and control channel by an attacker (or group of attackers). It should also be noted that you can paste in multiple domains at once, consolidating them into one investigation.

Conclusion

DomainTools Iris is a fantastic addition to your analysis toolset, providing insights into domains that are malicious, and even cooler those domains that will be malicious in the future! To see the full technical segment and Iris demo check out my segment on Paul’s Security Weekly:

While I used Iris on my own, there are some great collaborative features as you can add notes to your investigation and share with others on your team.

Paul Asadoorian

Paul Asadoorian is currently the Principal Security Researcher for Eclypsium, focused on firmware and supply chain security awareness. Paul’s passion for firmware security extends back many years to the WRT54G hacking days and reverse engineering firmware on IoT devices for fun. Paul and his long-time podcast co-host Larry Pesce co-authored the book “WRTG54G Ultimate Hacking” in 2007, which fueled the firmware hacking fire even more. Paul has worked in technology and information security for over 20 years, holding various security and engineering roles in a lottery company, university, ISP, independent penetration tester, and security product companies such as Tenable. In 2005 Paul founded Security Weekly, a weekly podcast dedicated to hacking and information security. In 2020 Security Weekly was acquired by the Cyberrisk Alliance. Paul is still the host of one of the longest-running security podcasts, Paul’s Security Weekly, he enjoys coding in Python & telling everyone he uses Linux.

Get daily email updates

SC Media's daily must-read of the most current and pressing daily news

By clicking the Subscribe button below, you agree to SC Media Terms of Use and Privacy Policy.

You can skip this ad in 5 seconds