Embed Notice

Today's CISA release has one big takeaway for me:

Establish. DNS. Authority.

If you can see and stop DNS queries in your environment, this "technique" is cut off at the knees.

In fact, I'd say DNS data is one of the most valuable telemetry sources you can collect as a defender. But DNS authority also means forcing your assets to use DNS servers of your choosing. If hosts can pick Quad 8 or whatever, you can see the query, but you can't stop it. Same goes for DNS-over-HTTPS.

Between DHCP, host, and firewall configuration, guarantee that all DNS queries in your network lass through a resolver under your control.

https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-093a