  Domain Name System (DNS) is the backbone of the Internet. However, threat
actors have abused the antiquated protocol to facilitate command-and-control
(C2) actions, to tunnel, or to exfiltrate sensitive information in novel ways.
The FireEye breach and Solarwinds intrusions of late 2020 demonstrated the
sophistication of hacker groups. Researchers were eager to reverse-engineer the
malware and eager to decode the encrypted traffic. Noticeably, organizations
were keen on being first to "solve the puzzle". Dr. Eric Cole of SANS Institute
routinely expressed "prevention is ideal, but detection is a must". Detection
analytics may not always provide the underlying context in encrypted traffic,
but will at least give a fighting chance for defenders to detect the anomaly.
SUNBURST is an open-source moniker for the backdoor that affected Solarwinds
Orion. While analyzing the malware with security vendor research, there is a
possible single-point-of-failure in the C2 phase of the Cyber Kill Chain
provides an avenue for defenders to exploit and detect the activity itself. One
small chance is better than none. The assumption is that encryption increases
entropy in strings. SUNBURST relied on encryption to exfiltrate data through
DNS queries of which the adversary prepended to registered Fully-Qualified
Domain Names (FQDNs). These FQDNs were typo-squatted to mimic Amazon Web
Services (AWS) domains. SUNBURST detection is possible through a simple
1-variable t-test across all DNS logs for a given day. The detection code is
located on GitHub (https://github.com/MalwareMorghulis/SUNBURST).
