Write the person-run DNS sinkhole steps

Aperta
  • Qualcosa non va?
#110 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
3/5
Tempo stimato
1-2 giorni
Idoneità per principianti
65/100
Tipo di issue
Documentazione
Chiarezza
Abbastanza chiara
Stato di attività
Attiva
Stack tecnologico
bash, powershell
Ambito
documentation, security, testing

Direzione di ricerca

Read design 14 section 5 and Blueprint section 4.6 for the sinkhole spec. On branch phase-9/dns-sinkhole, write the person-run steps and placeholder checks, then add bats and Pester tests confirming no automated DNS change and placeholder-only output. Done when docs and tests are present and pass.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

area: deception phase: deceive platform: windows type: build

Read first

Read these before starting. If this issue and the spec disagree, the spec wins; say so in the pull request.

Summary

Write the steps a person follows to sinkhole a command-and-control domain on a domain controller. A sinkhole answers a bad domain's DNS lookups with a harmless address instead of blocking it, so an implant that calls home is silently stranded and the attacker is not told. DNS is a scored service and a change on a domain controller reaches every machine, so Labyrinth never makes this change itself. It only prints the steps and the checks.

Depends on

  • Nothing.

Location & Context

  • Branch: phase-9/dns-sinkhole. A manual-only entry for the windows-dc profile, which prints the domain checklist (design 12, section 5). The specs do not name its module ID. Pick one by the phase.name rule in docs/design/README.md and say so in the pull request.
  • Its entry points print the steps with run-time values filled in. They send nothing to the domain controller. The repository copy holds placeholders only.
  • Tests: tests/phases/<phase>/<module>/ (new; Pester).

Current Behavior

The DNS sinkhole is not documented or built. It is person-run on a domain controller, because a DNS change there is too risky to automate.

Plan

  1. Write the person-run steps and printed checks for the sinkhole on a domain controller: test a DNS query before and after the change, and note that a setting on an Active Directory-integrated zone replicates to every domain controller.
  2. Change no DNS setting automatically.
  3. Keep every address and domain in the printed steps a placeholder in the repository, filled in only at run time.
  4. Add the entry to the windows-dc profile, its manual entry and its help page (about.txt).

Acceptance tests

Write these first, in Pester:

  • No DNS setting on the domain controller changes during an automated run.
  • The printed steps hold placeholders only.
  • Negative test: protected accounts and scored services are untouched before and after.

Done when

  • The Windows version passes CI, including the Windows Server runner.
  • The manual and the module's help page (about.txt) are written.
  • The entry is added to the windows-dc profile.
  • A person follows the printed steps on the lab domain controller, and a scoring-style DNS query passes before and after (docs/lab/README.md).

Out of scope

  • Outbound filtering: #78 (phase-4/firewall).
  • The outbound log rule and the search that finds the domains: #94 (phase-6/log-forwarding).
  • DNS overrides on a perimeter firewall: the appliance runbooks (#111).
  • The rest of the domain checklist (design 12, section 5).
Lingua principale
PowerShell
Stelle
0
Fork
0
Merge medio
2h 7m
PR unite (30g)
53

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di dotnetdork/Labyrinth

Tutte le issue di dotnetdork/Labyrinth

Issue simili

Altre issue su Documentation

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.