Blog DNS Threat Detection 
Webroot
MARCH 9, 2021
In that spirit, we put together this blog post to explain the different hacker types and methods they use against us. DNS (Domain Name System) is especially vulnerable. One of the most common methods of infiltration includes internet-based attacks, such as Denial of Service (DoS), Distributed Denial of Service (DDoS) and DNS poisoning.
Security Boulevard
AUGUST 7, 2024
HYAS Protect protective DNS uses advanced data analytics to proactively block cyber threats, a feature unavailable in legacy systems relying on static DNS filtering. AV-TEST , one of the cybersecurity industry’s most trusted evaluators, rates HYAS as the most effective protective DNS solution on the market.
This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.
CyberSecurity Insiders
MARCH 13, 2021
Stories from the SOC is a blog series that describes recent real-world security incident investigations conducted and reported by the AT&T SOC analyst team for AT&T Managed Threat Detection and Response customers. The post Stories from the SOC – DNS recon + exfiltration appeared first on Cybersecurity Insiders.
Security Boulevard
FEBRUARY 23, 2023
Thankfully, nearly all malware depends on DNS at some point in their kill chain, making the protocol a critical vector for shutting down these threats. Some of the common forms these DNS-based attacks can take include: DNS spoofing: A malicious actor alters DNS records to redirect traffic to a fake website or server.
Cisco Security
MARCH 16, 2021
In fact, 63% of threats detected by Cisco Stealthwatch in 2019 were in encrypted traffic. In this blog I’ll describe two recent privacy advances—DNS over HTTPS (DoH) and QUIC—and what we’re doing to maintain visibility. Keeping your destination private: DNS over HTTPS. DNS message encryption (control plane) is new.
Cisco Security
JUNE 13, 2022
Surely, someone must have written a blog or something more descriptive about this already,” they would say. Then, they would copy-paste anything that looks like a searchable term – an IP address, domain, SHA checksum – and start searching it, either on a threat intelligence search site or even a general-purpose search engine.
Cisco Security
AUGUST 11, 2021
We looked at REvil, also known as Sodinokibi or Sodin, earlier in the year in a Threat Trends blog on DNS Security. In it we talked about how REvil/Sodinokibi compromised far more endpoints than Ryuk, but had far less DNS communication. Figure 1-DNS activity surrounding REvil/Sodinokibi.
Expert insights. Personalized for you.
132 
Let's personalize your content