We are excited to announce a new detection type, identifying unusual DoT activity.
This detection notifies you of unusual DNS over TLS (Transport Layer Security) communication, often referred to as DoT, which could indicate attempts to blend malicious communications with regular encrypted web traffic to evade detection.
DNS over TLS (DoT)
DNS is a crucial part of infrastructure that maps out IP addresses for hosts connected to the internet through a process called DNS resolution, allowing users to access websites with user-friendly names rather than remembering specific IP addresses for sites.
DNS is a fundamentally “insecure” network whose communication can easily be intercepted. To avoid security risks, DNS needs TLS or HTTPS (Hypertext Transfer Protocol Secure) encryption protocols to improve network security.
TLS is a widely-used protocol that is designed to keep data secure in Internet communications. By using DNS over TLS, users can protect data that is being transferred, keeping it private even if it is intercepted. By using DNS over TLS (DoT), you send DNS requests over an encrypted TLS tunnel and can ensure the data is not readable by unauthorized parties – acting as a needed safeguard against data breaches.
This is why DoT has become a popular method of safeguarding DNS communications.
Indicators of Compromise
While DoT helps safeguard data, it can still be compromised by attackers. Upwind detects when a host or container in your cloud environment engages in DoT communication that deviates from established baseline behavior, which may indicate a “Command and Control” or “Defense Evasion” attempt using encrypted channels. This unusual communication could indicate an attacker’s method to compromise your system remotely, exfiltrate data, or deliver further payloads, blending malicious communications with regular encrypted web traffic to evade detection.
Upwind leverages runtime data to rapidly identify unusual DNS over TLS (DoT) communication and immediately alert you to suspicious activity. Read more about DNS over TLS (DoT) detections in the Upwind Documentation Center.
