Detecting Infected Devices with DNS Logs
Repeated blocked lookups can reveal compromised devices on your network. Here is how to use DNS reports.
DNS logs are a valuable but often overlooked security resource. Because almost all network activity starts with a DNS lookup, patterns in these logs can reveal infected devices long before other symptoms appear.
What to look for
- Repeated blocked lookups to malware or command-and-control domains from the same device.
- Lookups to random-looking domains, often generated by malware algorithms.
- Unusual volumes of DNS queries from a single device.
- Lookups at odd hours from devices that should be idle.
Identify the device
Match the source IP address in DNS logs with DHCP records or network inventories to identify the device and its user.
Isolate and investigate
Disconnect suspected devices from the network or move them to a quarantine VLAN. Scan them with security tools and check for unauthorised software.
Clean or rebuild
Depending on the severity, remove the malware or reinstall the operating system. Reset passwords used on the device.
Look for spread
Check whether other devices show similar patterns.
Learn the cause
Identify how the infection occurred — a phishing email, malicious download or unpatched software — and address the root cause.
Automate alerts
Configure alerts for high-risk categories so incidents are noticed quickly rather than discovered in monthly reports.
IoT devices
Cameras and other devices can be compromised too. DNS logs often reveal them because they rarely make unusual lookups otherwise.
Retention and privacy
Keep logs long enough for investigations, with access limited to authorised staff.
The bottom line
DNS logs provide early warning of infections. Review them regularly and act on suspicious patterns.
Learn more about Cloud DNS & Web Filtering from UbiFi, or talk to our team.
Protective DNS that blocks phishing, malware and unwanted content for every device on your network — no software to install.
