topic Re: E88.30 -Anti-Bot blocks access to malicious domain during the DNS resolution process.- in Endpoint

E88.30 -Anti-Bot blocks access to malicious domain during the DNS resolution process.-

emiliano_mastro — Wed, 01 May 2024 13:21:34 GMT

Hi,

I’m very happy to see important security enhancements with E88.30, in particular Anti-Bot that can block access to malicious domain during the DNS resolution process. Is it true also for IoC?

Because I have put a domain in IoC, but I can access it with telnet (no block during dns resolution process) although the access is blocked rightly using browser

Thanks a lot

Re: E88.30 -Anti-Bot blocks access to malicious domain during the DNS resolution process.-

PhoneBoy — Wed, 01 May 2024 14:18:54 GMT

Did you try it multiple times from the same client and see the same result?

Re: E88.30 -Anti-Bot blocks access to malicious domain during the DNS resolution process.-

emiliano_mastro — Wed, 01 May 2024 14:37:16 GMT

yes, same behavior

Re: E88.30 -Anti-Bot blocks access to malicious domain during the DNS resolution process.-

PhoneBoy — Fri, 03 May 2024 01:38:34 GMT

Not sure what the expected behavior is here.
Best to open a TAC case: https://help.checkpoint.com

Re: E88.30 -Anti-Bot blocks access to malicious domain during the DNS resolution process.-

JonnyRabinowitz — Mon, 06 May 2024 06:05:17 GMT

To close the loop here, this issue was addressed offline and was confirmed that the IoC is now blocked

To add some more color on the DNS detection related capabilities; beyond the validation of specific domains, the DNS traffic contents are analyzed to identify any suspicious patterns in the contents of the DNS messages that indicate malicious communications and such communications are blocked

Re: E88.30 -Anti-Bot blocks access to malicious domain during the DNS resolution process.-

emiliano_mastro — Mon, 06 May 2024 07:29:26 GMT

Hi,

I have opened a ticket to TAC who resolved. Now a domain, which belongs to IoC, is blocked if I try to open it with other application than browser like telnet, certutil and so on.