Beginner·250 points·1 solve
DNS Log Analysis
Learn that useful DNS detections are conjunctions: compute NXDOMAIN rate and Shannon entropy per host, understand with concrete counter-examples why neither measurement is usable alone, and identify the one DGA-infected host plus the single live command-and-control domain hiding among hundreds of failures.
The evidence lives in three files under /var/log/soc. dns-queries.log holds one week of 11,152 DNS queries from 46 workstations, seven fields per line (timestamp, client_ip, hostname, query_name, query_type, response_code, answer). dns-analysis-reference.md explains NXDOMAIN rate and Shannon entropy, how to compute each per host, and why neither is usable alone. network-notes.md records the estate's known noisy sources with a ticket against each; read the ticket state as well as the description, because they are not all the same and one of them is still open. The finding here is purely statistical — no single line is remarkable, and each measurement on its own has a loud, documented, entirely benign source in this estate that will rank near the top and account for the score. Only a host that is high on both at once has no benign explanation on record. That host is running a domain-generation algorithm, and among its many failed lookups the single name that resolved is the live command-and-control channel. Watch the unit you are measuring: entropy computed per NAME and entropy averaged per HOST rank differently, and the two answer different questions: one asks whether a name looks generated, the other whether a machine is generating them. Decide which one the question needs before you rank anything.
Your tasks
1
Measure NXDOMAIN rate per host
Aggregate response codes per host across dns-queries.log: total queries and NXDOMAIN count per hostname, expressed as a rate. Two hosts sit far above the rest of the estate, both over 50%, while every other host is under 3%. Two outliers is the point — a high failure rate on its own has never been evidence of anything, so neither of them is automatically the answer.
2
Rule out the documented benign sources
Read network-notes.md before forming a view. Both of the shapes you are measuring — a very high failure rate, and very random-looking names — have a loud, benign, already-ticketed source in this estate. Read each entry's ticket state rather than assuming: one source has been raised and closed repeatedly, another is recorded against a ticket that is still open, and a third runs under an approved change. Note the ticket against each source as you dismiss it. Being documented settles that source and only that source; it says nothing about whatever else is scoring high.
3
Combine the two measurements
Compute Shannon entropy of the queried labels; dns-analysis-reference.md has a snippet and reference bands to compare against. Mind the granularity. Rank the names themselves by entropy and the top of the list is a documented benign service whose keys are more random than anything malware generates — but that traffic is spread thinly across all 46 workstations, so it averages away in a per-host ranking. Cross the two per-host rankings, NXDOMAIN rate against label entropy, and exactly one host sits in the high-on-both cell with no documented cause. That is the host running the algorithm.
4
Find the one name that resolved
A domain-generation algorithm produces candidate rendezvous names until one is registered, and the operator registers exactly one. Filter that host's generated-name queries by response code. Among several hundred failures there is a single NOERROR carrying an address in the last field, and it looks identical to its neighbours — only the response code and the answer differ. That name and that address are the live channel; blocking the pattern accomplishes nothing.
5
Establish timing and map to MITRE
Sort that host's generated-name queries by timestamp and take the first, which approximates the infection time. Measure the gaps between consecutive queries as well: they are near-constant at roughly a minute and a half, which is a scheduled timer rather than a person at a keyboard. Then map the behaviour to a MITRE ATT&CK technique under the Command and Control tactic.
Answer the questions
Start the lab, investigate the evidence in the terminal, and answer the questions here.