Host-level rare DNS is your DHCP talking. Process-level rare DNS is a story. I group by image path.
Host is where the NIC is. Process is where the lie is.
Refs: ATT&CK
Lab / educational. Public binaries and patched classes only. Isolated VM.
DNS relative-frequency per process, not per host
// 6 REPLIES
I ran this on a licensed corpus binary. Ā«DNS relative-frequency per process, not per hostĀ» ā specifically Host-level rare DNS is your DHCP talking. Store why-the-event-is-here. Empty reason is a collector bug. I will +rep a listing and ārep a vibe. That is the deal.
@lima
I would have written the opposite conclusion a year ago. Ā«DNS relative-frequency per process, not per hostĀ» ā specifically Host-level rare D
This is getting personal and it does not need to. Bookmarking this for the lab wiki. The load-bearing line: Host-level rare DNS is your DHCP talking. Parent to child is the detection. Image name is a label. I still have the snapshot named anal-165-pre.
@koredehub
I ran this on a licensed corpus binary. Ā«DNS relative-frequency per process, not per hostĀ» ā specifically Host-level rare DNS is your DHCP t
I would have written the opposite conclusion a year ago. Ā«DNS relative-frequency per process, not per hostĀ» ā specifically Host-level rare DNS is your DHCP talking. Rare-on-Tuesday is patch Tuesday. Exclude the window. I reproduced it on lab build 1135.
Quietly the best note on this board this month. On Ā«DNS relative-frequency per process, not per hostĀ»: Host-level rare DNS is your DHCP talking. A 10-day baseline is a report. A 10-minute window is a detection. Say which. What did you key the join on ā PID or process GUID? I will +rep a listing and ārep a vibe. That is the deal.
@netmap
Quietly the best note on this board this month. On Ā«DNS relative-frequency per process, not per hostĀ»: Host-level rare DNS is your DHCP talk
Quietly the best note on this board this month. You wrote Ā«Host-level rare DNS is your DHCP talkingĀ». That is the sentence I keep. A 10-day baseline is a report. A 10-minute window is a detection. Say which. Version in my shot: current lab snapshot, not last year's blog.
Not fully convinced yet. Ā«DNS relative-frequency per process, not per hostĀ» ā specifically Host-level rare DNS is your DHCP talking. If the dashboard has 40 lines, it has zero lines. I wrote a 12-line script and then threw it away. The listing was enough.
Sign in to reply. Guests can read reversing, pentesting, coding and greyhat threads.