Ransomware attacks do not happen in minutes. In a typical attack there are hours, sometimes days, between initial access and encryption. During that time the malware talks to its command server, downloads extra tools and explores the network. And almost every step starts with a DNS query.
The first signal is in DNS
Command servers usually use newly registered, short-lived or algorithmically generated names. Defender evaluates these queries in several layers:
- Threat intelligence: RPZ zones, TAXII 2.1 and MISP feeds, URL lists. If the name, the answer IP or the name's authoritative server is known bad infrastructure, the query is blocked.
- AI categorization: names never seen before are judged by their category and risk score.
- Behavior: newly registered domains, DGA-generated names and DNS tunnel detection.
A blocked query does not go unanswered; the client receives a block answer and the connection is never made.
Blocking is not enough: the device is still infected
A blocked C2 query is proof that something is running on that computer. The real job is to clean the device, and speed is everything.
NameDefence wires alarms to outside systems automatically:
- An alarm is raised: which user, which computer, which domain, which rule.
- A ticket opens in ServiceNow or Jira with the severity and details. If you prefer, a signed webhook goes to your own automation.
- The device is isolated from the network through the endpoint protection product. CrowdStrike Falcon and Microsoft Defender for Endpoint are supported directly.
- The same device can be quarantined on the DNS side too.
An alarm at three in the morning does not wait for the team to arrive.
Who else is affected?
When C2 is seen on one device, the first question is whether others reached the same infrastructure. In the threat hunting view you move from domain to IP and from IP to other domains hosted at the same address, drawing the attacker's infrastructure as a graph. Passive DNS history keeps which IPs a domain resolved to in the past, so the trail survives even when the infrastructure changes.
In short
Ransomware arrives quietly, but the first thing it does is ask DNS. Block that first query, automate the ticket and the isolation, and you have a chance to stop the attack before encryption begins.