Hacker News Reader

I’ve never seen anyone try and setup alerts for random DNS queries. If you’re in the position to know what domains are good, then why not simply use a whitelist?

Besides, even if you saw these queries you’d have no easy way of know I’d they were malicious or not.

View on HN

Some IDS systems do it for you I was using Darktrace at my last job and it would tell us when servers started querying domains they don't usually query so there are products that do it

Those systems usually flag based on a known set of “bad” domains, which wouldn’t stop this attack (they could just register a few new domains before starting the attack).

Reply on news.ycombinator.com