DNS Record Misdirection

Description

Create DNS entries that point to deception assets using names that suggest high-value internal resources. Adversaries who perform DNS enumeration will discover these records and follow them to deception infrastructure, believing they have found legitimate targets.

Rationale

DNS enumeration is one of the first things adversaries do after gaining internal network access. They query for hosts, zones, and service records to map the environment. Carefully crafted DNS entries serve as natural lures that guide adversaries toward deception assets through a discovery mechanism the adversary already trusts.

Peer-reviewed sources support DNS-based honeytokens and deceptive network responses, but a direct peer-reviewed study of defensive fake-DNS-record lures was not established.

The exact fake-authoritative-DNS-record mechanism is described by Roy et al. in a non-peer-reviewed preprint.

• Roy, S. et al. Adversarial Reconnaissance Mitigation and Modeling. arXiv:2306.06769, 2023.Preprint
• Srinivasa, S.; Pedersen, J.M.; Vasilomanolakis, E. Towards Systematic Honeytoken Fingerprinting. SIN 2020, 1–5.Peer reviewed
• Trassare, S.T.; Beverly, R.; Alderson, D. A Technique for Network Topology Deception. MILCOM 2013, 1795–1800.Peer reviewed

These sources establish design lineage and scope. They do not validate this record's operational effectiveness, planning estimates, environment labels, or ATT&CK relationships.

Implementation Steps

Technical Implementation Examples(1)

# modules/dns-misdirection/main.tf

variable "hosted_zone_id" {
  description = "Route53 hosted zone for internal DNS"
  type        = string
}

variable "deception_hosts" {
  description = "Map of deception hostname to IP"
  type        = map(string)
  default = {
    "prod-db-04"          = "10.200.30.10"
    "prod-db-04-read"     = "10.200.30.11"
    "admin-portal"        = "10.200.40.10"
    "fileserver-finance"  = "10.200.10.30"
    "backup-nas-02"       = "10.200.10.40"
    "deploy-srv"          = "10.200.20.10"
    "vault"               = "10.200.40.30"
    "jenkins-prod"        = "10.200.20.20"
  }
}

resource "aws_route53_record" "deception" {
  for_each = var.deception_hosts

  zone_id = var.hosted_zone_id
  name    = "${each.key}.corp.internal"
  type    = "A"
  ttl     = 300
  records = [each.value]
}

# Reverse DNS for consistency (adversaries check PTR records)
resource "aws_route53_record" "deception_ptr" {
  for_each = var.deception_hosts

  zone_id = var.reverse_zone_id
  name    = "${join(".", reverse(split(".", each.value)))}.in-addr.arpa"
  type    = "PTR"
  ttl     = 300
  records = ["${each.key}.corp.internal"]
}

# DNS query logging to detect reconnaissance
resource "aws_route53_resolver_query_log_config" "deception_dns" {
  name            = "shadow-cdf-dns-queries"
  destination_arn = var.cloudwatch_log_group_arn
}

MITRE ATT&CK Mappings

Considerations

• Include reverse DNS entries. Forward-only records without PTR records are an inconsistency that sophisticated adversaries may notice.
• DNS zone transfers, where enabled, should include deception entries seamlessly mixed with production entries.
• Monitor query volume. A burst of queries for deception hostnames may indicate automated enumeration.