Splunk Enterprise Security

Can anyone recommend a relevant public malware domain list?

Communicator

Hello,

I find that the default malware domain list used by Splunk ES (that of malwaredomains.com) is not very relevant: it contains a lot of business services, new sites, etc., so ES generates a lot of false positives.

I’d like to know if anyone has experience of using any other public malware domain lists and/or if there are some you could recommend.

Thanks for the help.

Regards,
Alexey.

0 Karma

Splunk Employee
Splunk Employee

Hello @AlexeySh - while I don't have any recommendations for free malware domain lists (hopefully others will chime in). That said, do you have some examples of false positives that are on the list that are showing up?

0 Karma

Communicator

Hello @kchamplin [Splunk],

Sure, here is some detection we had recently:

widoobiz.com – broadcast Media
mon-poeme.fr – leisure website
mlsend.com – business communication
safelinks.protection.outlook.com – webmail
gandi.net – domain name management

Fortunately, we do not have a huge volume of false positives, but still there is always some legitimate websites detected every week including a new ones so it’s kind of hard to whitelist.

Regards,
Alexey.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!