D3-DNS-D

DNS Sinkhole

Redirect DNS queries for known malicious domains to controlled infrastructure for detection and analysis.

D3FEND / Deceive

Implementation

  • Configure DNS sinkhole infrastructure
  • Subscribe to threat intelligence feeds
  • Log all sinkholed queries
  • Alert on internal client hits
  • Analyze traffic patterns

Tools

  • Cisco Umbrella
  • Infoblox
  • Response Policy Zones
  • BIND
  • Pi-hole

ATT&CK mappings

3

MITRE D3FEND ↗