Palo Alto DNS Security

 

static bad domain list comes with threat content update (default-laoalto-dns)

Advance DNS security requires DNS Security License, query cloud

DNS security is configured in Anti Spyware profile.

Flightsim

https://github.com/alphasoc/flightsim

flightsim is an application which generates malicious network traffic for security

teams to evaluate security controls (e.g. firewalls) and ensure that monitoring tools

are able to detect malicious traffic.

Test URLs:

Malware - test-malware.testpanw.com
C2 - test-c2.testpanw.com
DGA - test-dga.testpanw.com
DNS Tunneling - test-dnstun.testpanw.com

A domain generation algorithm (DGA) is a program that generates large numbers of new domain names. Cybercriminals and botnet operators use domain generation algorithms to frequently change the domains they use to launch malware attacks.

Besides PA provided bad DNS list, EDL can be created