Malware › Module 7 › Lesson 2
DNS HTTP Cues
DNS and HTTP indicators from $MAL_LAB dynamic runs — query names, User-Agent, URI patterns as IOC literacy.
Visual · t22_dns_http_cues
DNS/HTTP cues = network IOC candidates. $MAL_LAB. Original Cyberlium.
Opening
Callbacks often shout in DNS before TLS hides — learn the cues defenders block, not how to register lookalike domains for crime.
DNS cues include suspicious query names (long random subdomains, DGA-like patterns, rare TLDs), query types, and timing relative to detonation. HTTP cues in cleartext lab traffic: method, URI path, User-Agent strings, Host header, POST body size patterns — map to malware family categories at literacy level. Analysts document cues as IOC candidates with confidence tags (observed in $MAL_LAB, not global threat intel paste). Cyberlium teaches reading cues from YOUR isolated capture — NOT registering C2 domains, NOT building DNS tunnel exfil tools, NOT phishing pages mimicking cues for stranger targets. Share domains as defensive IOCs through proper channels — hashes and domains, not live samples casually.
1. DNS indicators
First query after detonation, query frequency, NXDOMAIN bursts, TXT record oddities — category names for notes.
DGA literacy: algorithm-generated names look random — detection is pattern-based, not reverse-engineering DGA for offense.
Command guide
Try these commands — DNS indicators
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Listening ports — https://learn.microsoft.com/en-us/windows/security/threat-protection/ (unexpected listeners literacy) Hybrid Analysis network — https://www.hybrid-analysis.com/ (sandbox network tab literacy)
═══ INSTALL ═══
Linux (Debian/Ubuntu): Built-in (iproute2)
macOS: Use: netstat
Windows: Use: netstat
═══ LINUX / macOS ═══
Command — copy this
source "$HOME/cyberlium-lab/t22-mal/lab.env" 2>/dev/null || export LAB_HOST=${LAB_HOST:-127.0.0.1}
ss -tulpn 2>/dev/null | head -20
ss -tulpn 2>/dev/null | grep -E '127\.0\.0\.1|:22 |:53 ' | head -8Primary tools to practice this lesson: ss. Reference sites: Listening ports (https://learn.microsoft.com/en-us/windows/security/threat-protection/); Hybrid Analysis network (https://www.hybrid-analysis.com/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. HTTP indicators
Non-browser User-Agent from sample process, URI with encoded blobs, periodic GET/POST to same path — redact full URI in public share.
TLS hides payload but SNI/JA3 metadata still IOC-class at literacy level from $MAL_LAB PCAP.
3. IOC hygiene preview
Mark observed vs inferred; include UTC observation window and sample hash link.
Never publish live sample + domain pair to open forum — defenders ingest IOCs, attackers harvest them.
4. What you ship: DNS/HTTP cues table
≥4 cue rows with type, redacted value, confidence, link to dynamic lab UTC.
5. What you record before the next lesson
DNS/HTTP cues table path.
6. Wrong vs right: live malware on daily driver vs sandbox
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Register lookalike domain from lab cue to 'test blue team' on production.
Right
DNS/HTTP cues table from $MAL_LAB. Next: Process Tree.
Mission: DNS/HTTP cues table
1) Extract ≥2 DNS cues from PCAP. 2) Extract ≥2 HTTP cues if present. 3) Tag observed vs inferred. 4) Redact before share.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “SNI-only TLS — enough for IOC row?”
Knowledge Check
APPLY: DNS/HTTP cues come from:
Multiple choice
Knowledge Check
APPLY: True or False: Register C2 lookalikes for stranger targets is lab.
True or False
Knowledge Check
APPLY: Share DNS IOCs as:
Multiple choice