Understanding how threat actors transport malicious code
In this section, you will learn how threat actors use trusted protocols to help transport their malicious code, such as exploits, across a network and even exfiltrate data without being detected. You will learn how DNS, NTP, HTTP and HTTPS, and email-based traffic can be easily overlooked on a corporate network.
The domain name system
Each day, there are millions of devices that exchange domain name system (DNS) messages between servers on private networks and the internet. The DNS is a network protocol that allows you to resolve a hostname to an IP address. To put it simply, imagine you want to visit Cisco's website at www.cisco.com. Since each device on a network and the internet requires an IP address, you will need the IP address for Cisco's website.
Unfortunately, many people do not know the IP addresses of any of the servers we visit on a daily basis. To save us the trouble, a DNS server is like a huge...
