Implement Frequency Score meta to Domain names

[Anonymous]

I recently discovered an interesting way to add some intelligence surrounding the randomness of domain names and I'm curious about how to implement it in NetWitness.

I'm looking at the following tool.

FreqServer · Security-Onion-Solutions/security-onion Wiki · GitHub 

I have an idea about how to implement within NetWitness, that would include an external script querying the API for a list of domain names, run it against the freq_server tool, then generate a feed of domain names and randomness scores that could populate a new meta key

If there is another way to do this, I'd be interested to hear about it.

Cheers.

[MatthewTharp1]

Hey Jeremy, this isn't the same technique but it might be useful to you and is already built.

https://community.rsa.com/thread/191520 

[Anonymous]

Thanks, it looks interesting. I might implement both 🙂

[Anonymous]

I was also thinking of that DNS Tunneling article as well.  I think a feed and a report could work, though it might be slightly behind depending on the feed update interval. 

[Anonymous]

Thanks, after looking at your technique, it looks very similar to what I'm looking for so I'll go with that. 

Cheers.