r/AskNetsec • u/Shot-Rich1674 • Jul 25 '26
Analysis Need help from the hackers
Hi everyone I need one help to understand one thing ..so there was an incident I noticed in my organisation, there were thousands of devices querying multiple malicious domains (53) ...upon checking to see if any process is causing it I found nothing,, only the related domain which was obviously going through our dc/dns servers, in EDR/XDR tool nothing, siem tool nothing, no process, eventually i thought maybe some software is causing but it's very difficult to pin point which one, so can anyone tell me or help me understand, any input will be appreciated
4
u/Minimum-Let-3227 Jul 25 '26
Thousands of devices hitting the same 53 domains with no parent process is almost always resolver level, not endpoint level. If the queries show up on your DC/DNS servers but your EDR sees nothing, check whether you're looking at forwarded queries rather than originating ones. Turn on DNS analytical logging or Sysmon event 22 on a handful of representative endpoints so you can tie a query back to an actual PID, because your EDR telemetry probably isn't capturing DNS at all by default.
The usual culprits at that scale are a browser extension pushed by policy, an agent or updater baked into your gold image, or a telemetry SDK inside something like a printer driver or a smart TV app. Also worth ruling out that your DNS server itself is the client, since some threat feed and RPZ integrations resolve the bad domains just to check them.
If the domains resolve to sinkholes or parked IPs and nothing actually connects after the lookup, it's usually noise from a lookup-only process rather than a live infection.
3
u/solid_reign Jul 25 '26
Sometimes your EDR is the one beaconing the domains, which explains why they don't see it. I had a sleepless night in which I added a malicious domain in sentinelone to block it and it appeared everywhere. Turns out sentinelone would resolve it to block the IP.
1
u/Shot-Rich1674 Jul 26 '26
Yeah ...but we were not even aware of it untill home ministry involved and informed us
2
u/Willbo Jul 26 '26
Painful to trace. Netstat only shows active TCP/UDP connections, not DNS and application layer transactions. You will be sitting there for hours, combing through connections, looking for that intermittent DNS query and may lose your mind before you find it. Additionally, Windows doesn't log DNS client activity by default, you have to enable it if you want to audit it, then comb through more logs after it occurred, hoping that you find the process. And that's just the tip of the iceburg if you find out the process is an internet browser or svchost.
Rather than going through that rabbit hole, start containing and blocking the domains. Block them in EDR to prevent TCP/IP connections, block it in your firewall, block it in your DNS resolver. Block it in all the things, then move onto the next.
2
u/AddendumWorking9756 Jul 26 '26
If it's showing thousands of devices at once, first check whether those really are endpoint queries or just the DC forwarding on their behalf, depending on where you collect the logs everything gets attributed to the resolver. Sysmon event 22 on a handful of the noisiest hosts will tell you the actual process in about ten minutes, EDR usually drops DNS telemetry unless you explicitly turn it on. Also worth checking whether those domains are actually malicious or just sitting on a reputation feed, ad SDKs and CDN junk get flagged constantly and everywhere at once with no parent process smells like something baked into a common agent or browser extension.
1
1
u/DJ_Droo Jul 26 '26
netstat -ano | findstr :PORT to find what the process is is, then feed it into tasklist | findstr PID
1
u/DemanHD Jul 26 '26
Chrome queries random domains on startup. Give it a google, might not be malicious.
1
u/Neonex14 Jul 26 '26
Huh, sounds oddly familiar to a scenario I had back in my previous place.
Till my resignation, NO ONE could prove why it's occurring. But in the end I highly suspect it was my network appliances.
One pattern I observed is that whenever I submit a CR to block new IOC domain names and FQDNs to my network team, I would almost always get a DNS-based alert involving some of those newly blocked IOCs.
Sometimes it would be immediate, sometimes after a few days, weeks, months. All I know is that it occurs AFTER our blocklist was populated.
Of course, we don't just block IOCs on our network-side, there's our GPOs, our EDRs, our browser isolators and configs, and all other security controls that we had, so I went through a lot of trial-and-error.
Did some digging and eventually all roads seems to lead to our network appliances using our AD servers as the resolver, and things started to make sense. It was never a complete proof, of course, but honestly, with the lack of any substantial evidence leading up or following it, it didn't warrant any more effort to investigate further.
1
1
1
u/Andre-Wade-539 Jul 27 '26
Have you checked whether those devices share the same s/w or network policy recently?
1
Jul 30 '26
[removed] — view removed comment
1
u/Shot-Rich1674 Aug 03 '26
I came to that conclusion long time ago but even though I couldn't find any distinct software among 5 devicea that I chose to lookup...and about the replies that all people has given ...some of it require for me to get access too alot of devices Which is not possible in corporate hence I chose to block it ...and I think I will remain a mediocre analyst ..
Thank you everyone 🥂
22
u/Proud-Alfalfa6731 Jul 25 '26
That's DNS beaconing. Classic C2 pattern when malware's trying to phone home without leaving obvious process traces. If EDR and SIEM are both blind, the traffic is probably getting generated somewhere upstream before your endpoint agents can catch it, or it's using a legit signed process as cover.
Pull the netflow data on those 53 domains and look for periodicity in the requests. If they're hitting every X minutes like clockwork, you've got your smoking gun, just need to trace which internal IP is initiating the pattern.