Add Ability to Capture DNS Servers & DNS Search Order in System Object

CybOXProject / schemas

CybOX Schemas and Schema Development

42 stars 17 forks source link

Add Ability to Capture DNS Servers & DNS Search Order in System Object #329

Open ikiril01 opened 9 years ago

ikiril01 commented 9 years ago

We should add the ability to characterize DNS client configuration, including the DNS servers used by the client and DNS server search order*. It would likely make the most sense to add this as part of the existing System Object, specifically in the NetworkInterfaceType.

As seen in /etc/resolv.conf on Linux or with the following WMI query: PS C:> gwmi -query "Select DNSDomain, DNSDomainSuffixSearchOrder, DNSServerSearchOrder from Win32_NetworkAdapterConfiguration where IPEnabled=1"

destijl commented 9 years ago

While windows associates the DNS information with a network interface, Linux and OS X don't, so its probably better as a separate object.

ikiril01 commented 9 years ago

Ah, good to know @destijl. I agree then that creating a separate DNSClientInfo (or some such) type would probably be the best course of action.

ikiril01 commented 9 years ago

Context: this was requested by a community member, and would be most relevant for digital forensics and malware related use cases, where the DNS search order may have been modified by a malware instance (for example).

LOE: Medium