[Autogenerated] In this module,
we'll be taking a look at a more advanced example of DNS exploitation.
We are gonna adopt the role of an incident responder.
And we've been given a PC file containing some interesting DNS traffic.
The attacker is using DNS and sub domains to transport
command and control information between the compromised
host and the attacker's domain.
But why DNS when an attacker creates a CTW channel,
a primary objective is blending into the normal traffic to avoid detection.
DNS rarely has security controls is extremely common
and is very noisy within a network.
This makes anomalies difficult to detect and makes it a
perfect place for an adversary to hide.
Two things are important before we dive in.
First, we'll be using a tool called Zeek to analyze the PCA file.
Zeek is an open source tool that performs session and
protocol analysis for network traffic.
But also lets us create and use custom scripts.
We will be using a custom script to perform entropy analysis.
Entropy is a measure of randomness or diversity of a dataset data with
full entropy or high values is completely random and no meaningful
patterns can be found low entropy values indicate an ability or
possibility to predict forthcoming values.