Sign In
- Platform
- Solutions
- Modern NDR
- Resources
- Company
Platform
Modern NDR
Resources
Platform
Modern NDR
Resources
DETECTION OVERVIEW
Risk Factors
Setting up a successful rogue DNS server is a complicated endeavor. While uncommon, the presence of a rogue DNS server on a network indicates that clients might be vulnerable to other attacks, such as man-in-the-middle, phishing, or pharming, which might lead to information exposure.
The system might change the risk score for this detection.
Kill Chain
Risk Score
61
A rogue DNS server is a powerful technique for directing victims to attacker-controlled servers. First, the attacker either gains access to a device on the network with admin privileges, or the attacker connects a new device, such as a Raspberry Pi, to a network through an ethernet cable or to a wireless network. Next, the attacker configures the device to store malicious domain records and act as a DNS server. Finally, the attacker employs various techniques that configure network clients to communicate with the rogue DNS server. When the client tries to resolve the domain name of a legitimate host, the rogue DNS server responds with the IP address for the attacker-controlled host. The client is now redirected to the malicious host, enabling the attacker to send malicious content to the client or trick users into revealing sensitive information.
Quarantine the potential rogue DNS server and check for other malicious activity
Require all DNS clients to send queries to a legitimate DNS server that filters or blocks suspicious domains and IP addresses
Check the domain records stored on this device for IP addresses that match threat intelligence data
