Azure Sentinel: Using Custom Logs and DNSTwist to Monitor Malicious Similar Domains
In this article, we are going to explore how to monitor similar domains to yours, in order to protect your users from being victims of social engineering attacks.
When performing computer-based social engineering attacks such as phishing, attackers buy similar domains to yours in order to trick your users. This is why keeping an eye on similar domains is essential to avoid such attacks.
First we need to find these domains. One of the tools that helps you to generate similar domains is "DNS Twist". You can find it here: https://github.com/elceef/dnstwist
According to DNS Twist developers:
"DNS fuzzing is an automated workflow for discovering potentially malicious domains targeting your organisation. This tool works by generating a large list of permutations based on a domain name you provide and then checking if any of those permutations are in use. Additionally, it can generate fuzzy hashes of the web pages to see if they are part of an ongoing phishing attack or brand impersonation, and much more!"
You can even try to generate some domains online here: https://dnstwist.it
In this demonstration, we are going to use python on Windows to generate similar domains:
Type the following command to install the python module:
py -m pip install dnstwist
To generate similar domains, open python terminal and type:
import dnstwist fuzz = dnstwist.DomainFuzz(“<YOUR DOMAIN HERE>”) fuzz.generate() fuzz.domains
For example these are some similar domains to "google.com" after parsing only the domain names:
You can also use this API: https://dnstwister.report/api/
To store the similar domains you can build a small script to achieve that. For example the following snippet stores similar domains in a file called "Similar-Domains.txt"
Once, we have a file that contains the similar domains, now we need to send them to sentinel so later we can create rules based on them.
Go to "Custom logs" sections and upload a log sample (a snippet from your similar domains file)
Select the limit delimiter: New Line
Add the file path. In my case "C:\Users\Computer\Similar-Domains.txt". If you have many log files you can use regular expression such as * eg: C:\Users\Computer*.txt
Add a name and description to your custom log source
Voila! Your custom log is created successfully
Go to Sentinel log section and you will find it under Custom Logs
To query it, simply select its name as follows: