D3-DNSAL
DNS Allowlisting
Restrict DNS resolution to approved domains to prevent communication with malicious infrastructure.
D3FEND / Isolate
Implementation
- Deploy DNS filtering solution
- Block newly registered domains
- Restrict outbound DNS to corporate resolvers
- Monitor DNS query patterns
- Implement response policy zones
Tools
- Cisco Umbrella
- Infoblox
- Pi-hole
- Cloudflare Gateway
- Palo Alto DNS Security
ATT&CK mappings
3