Glossary

Domain generation algorithm (DGA)

Threat actors use DGA to calculate a sequence of domain names that infected devices on the organization's local area network will attempt to connect to. This prevents loss of control over the compromised infrastructure in cases where the attacker's hardcoded domains or IP addresses are blocked by security systems.

DNS tunneling

Hiding data and commands from detection by monitoring systems during the transmission of messages via the DNS protocol, which attackers can use to establish a communication channel with C2 servers.

DNS over HTTPS (DoH)

The protocol for performing DNS resolution over HTTPS.

DNS over TLS (DoT)

The protocol for performing DNS resolution using TLS.

Multitenancy

A software architecture that allows users from different organizations to work simultaneously and independently of each other. Users only have access to their organization's configuration and data set.

Authoritative DNS server

A DNS server that provides an update mechanism used by developers to manage public DNS names. An authoritative DNS server is fully responsible for a domain and provides IP address information in response to queries from recursive resolvers.

Private domain

A domain located within your organization's local area network.

Private domain zone

A domain zone located within your organization's local area network.

Public domain

A domain accessible from the Internet.

Private DNS server

A DNS server that serves private domains.

Indicator of compromise (IoC)

An object (or activity) on the network that is highly likely to indicate malicious activity.

Location

A type of organization under which at least one host of recursive resolution is deployed in multitenancy mode—that is, capable of serving multiple organizations simultaneously.

Resolving

Resolving domain names to IP addresses using a DNS server.

Recursive resolver

A DNS server that stores information about domains in a cache or permanent storage for a certain period of time. If the recursive resolver's cache contains information about the queried domain, it responds to the DNS query by returning the IP address. If the cache does not contain the necessary information, the recursive resolver forwards the query to one or more authoritative DNS servers.

RKN (Roskomnadzor)

The Federal Service for Supervision of Communications, Information Technology, and Mass Media

Bot control server

C&C server, Command & Control, C2—a command server used by threat actors to control a botnet, manage malware, and gain control over devices on an organization's local area network.

Host of recursive resolution

A physical or virtual server that hosts a recursive resolver.

Data exfiltration

Unauthorized copying, transfer, or retrieval of data from a victim's device. As a rule, threat actors compress and encrypt data during transfer to avoid detection.