Firewall, DNS and proxy logs

Endpoint logs tell you what a process did. Network logs tell you who it talked to. During an investigation, you usually need both to build a path.

Firewall logs: the five-tuple

A typical firewall record includes source IP, source port, destination IP, destination port, protocol and a verdict (allow or deny).

ALLOW TCP 10.0.4.21:51544 -> 203.0.113.50:443
DENY  TCP 10.0.4.21:51545 -> 198.51.100.7:22

Useful questions:

• Which internal hosts are talking to an unfamiliar external address?
• Is a workstation attempting management ports it should never use?
• Is outbound traffic suddenly much larger than baseline?
• Which denied connections repeat in a pattern?

DNS logs: the names behind the addresses

DNS logs show the names a host tried to resolve. They are valuable because malware often resolves a domain before it connects, and because blocked queries reveal attempted command-and-control.

Look for:

• newly registered or algorithmically generated names;
• a workstation querying a domain unrelated to its role;
• repeated TXT or long subdomain queries, which can indicate tunnelling;
• a high volume of NXDOMAIN responses from one host.