...
- Threat Insight – DNS Messenger: The default action for this policy is Log. This list helps minimize the risk of malicious activities that are brought upon your networks through the DNSMessenger malware, a Remote Access Trojan (RAT), that attackers use to conduct malicious Powershell commands on compromised devices.
- Threat Insight – - Rapid Domain Triage: The default action for this policy is Block - No Redirect. This list examines DNS logs to determine if a newly reported domain may present a threat to an organization. If it is determined that it may pose a threat, then the newly reported domain will be added to the Threat Insight - Rapid Domain Triage list for quarantine for a period of 48 hours. Domains added to the Threat Insight - Rapid Domain Triage list will undergo further investigation to confirm whether it presents a threat. Based on the results of the investigation, if the domain is determined not to present a threat then it will be removed from the quarantine list and added to an allow list, or added to a TIDE RPZ feed. If, however, it is determined the domain does present a threat, then it will be added to a block list. Threat Insight – Fast Flux: The default action for this policy is Log. This list helps minimize the risk of malicious activities that are brought upon your networks using the Fast Flux technique. Fast Flux is a DNS technique used by botnets to hide phishing and malware delivery sites behind a network of compromised hosts acting as proxies. It can also be a combination of peer-to-peer networking, distributed command and control, web-based load balancing and proxy redirection used to make malware networks more resistant to discovery.
- Threat Insight – DGA: The default action for this policy is Log. This list helps minimize the risk of malicious activities that are brought upon your networks using the Domain Generation Algorithm (DGA). DGA is a scheme used by malwares for domain fluxing by generating variations of a given domain name. They can be used to create a large number of domain names used as rendezvous points with command and control servers, in an attempt to evade detection by signature filters, block lists, reputation systems, security gateways, intrusion prevention systems, and other security methods.
...