Threat Hunting via DNS with Eric Conrad - SANS Blue Team Summit 2020

DNS logs are one of the most powerful threat hunting resources, but encryption is rapidly changing that equation.
Key DNS threat hunting techniques include detecting DNS tunneling and Domain Generation Algorithms (DGAs). It used to be simple(r): log DNS requests and responses on DNS forwarders, or sniff and analyze via tools like Zeek.
DNS over TLS (DoT) and DNS over HTTPS (DoH) are disrupting the status quo: where does that leave network defenders? This talk will analyze the current state of DNS monitoring, and provide actionable steps for detecting malice on your network via DNS.
Eric Conrad @eric_conrad Fellow, SANS Institute

[@NeonNotch]

This man is part of the 1% of individuals. Highly intelligent, charismatic, easy to understand. Great talk, thank you!

[@Francois-B-Arthanas]

Eric - You are amazing 🤩. Thank you 🙏 for everything you do for the Cyber community.

[@vonniehudson]

NULL records… taking that one home. Never knew about that

[@sidss007]

Your course on Building your own cyber lab is awesome.

[@vonniehudson]

@@sidss007 which one?

[@dustyrose8010]

@@vonniehudson hi I'm dusty

[@sammo7877]

I'm not going to get into the encrypted DNS debate - gets into the debate :D great talk btw!

[@mohammadaassif]

Sir Eric - You are amazing in your teaching method i am fun.

[@mar002007]

Is this the Nelson Sullivan’s Eric?