...
- Threat Insight – DNS Messenger: The default action for this policy is Log. This list helps minimize the risk of malicious activities that are brought upon your networks through the DNSMessenger malware, a Remote Access Trojan (RAT), that attackers use to conduct malicious Powershell commands on compromised devices.
- Threat Insight – Rapid Domain Triage: Rapid Domain Triage detects new domains observed in customer traffic to protect them from any possible targetted or Spearphishing attacks. It follows a low regret model and blocks the domain for a short TTL of 48 hours. The domain is released after 48 hpurs, by which time other security systems in place should have enough information about this new domain to protect per policy. The default recommended action for this The TI-List is Block - No Redirect. The intent of this detection is to provide very near real-time protection on new domains used quickly in attack sequence (can detect and block within 1-2 minutes of usage). Oftentimes the new domains are not mission critical and following a low regret model, therefore it is best to have this protection in place. If for any reason the detected domains are known, are verified, and needed for use, they can be added to the Default Allow list to bypass the detection.Threat Insight – Fast Flux: The default action for this policy is Log. This list helps minimize the risk of malicious activities that are brought upon your networks using the Fast Flux technique. Fast Flux is a DNS technique used by botnets to hide phishing and malware delivery sites behind a network of compromised hosts acting as proxies. It can also be a combination of peer-to-peer networking, distributed command and control, web-based load balancing and proxy redirection used to make malware networks more resistant to discovery.
- Threat Insight – DGA: The default action for this policy is Log. This list helps minimize the risk of malicious activities that are brought upon your networks using the Domain Generation Algorithm (DGA). DGA is a scheme used by malwares for domain fluxing by generating variations of a given domain name. They can be used to create a large number of domain names used as rendezvous points with command and control servers, in an attempt to evade detection by signature filters, block lists, reputation systems, security gateways, intrusion prevention systems, and other security methods.
- Threat Insight - Zero Day DNS: The default action for Zero Day DNS is Block-No Redirect.. This list features real-time streaming detection. It is designed to identify domains implicated in threat campaigns immediately after their registration, eliminating the aging period. It effectively blocks threat indicators in the initial stage of the threat lifecycle, specifically within 1 to 2 minutes following their registration. This proactive approach ensures the protection of our users against threats even before the commencement of the threat campaign. Infoblox blocks these domains using short duration TTL of 48 hours by which time other security system in place will have enough information to protect per the exisitng policy.
...