Find the shadow IT your own DNS log already knows about

short · 35 min · Objective 2.1

Task

Use DNS query logs from your own lab to discover which external services a machine is talking to, and sort them into sanctioned and unsanctioned. This is exactly how shadow IT is found in a real estate, and it needs no product.

Steps

  1. Install and start dnsmasq on the Linux VM, configured to log queries: add log-queries and log-facility=/var/log/dnsmasq.log to its configuration and restart it.
  2. Point the VM's resolver at itself, then generate a realistic query mix with dig: a dozen names you would consider sanctioned and half a dozen you would not — file-sharing, note-taking and AI services are the usual real-world finds.
  3. Extract the queried names and their counts: awk '/query\[A\]/ {print $6}' /var/log/dnsmasq.log | sort | uniq -c | sort -rn > /tmp/domains.txt.
  4. Classify each into /tmp/shadow.csv as domain,sanctioned,data_risk, where data_risk says what could leave through it.
  5. For each unsanctioned entry, write the likely reason somebody reached for it — what the sanctioned alternative fails to do.
  6. Propose one control per unsanctioned service and mark whether it is discovery, blocking, or providing an alternative.

Verify

wc -l < /tmp/domains.txt
awk -F, 'NR>1 && $2 ~ /no/ {n++} END {print n" unsanctioned service(s) found"}' /tmp/shadow.csv
awk -F, 'NR>1 && $2 ~ /no/ && length($3)<5 {n++} END {print (n+0)" unsanctioned entries with no stated data risk"}' /tmp/shadow.csv

The first must be at least twelve — there is a real query log. The second must be non-zero, or you did not generate the unsanctioned half. The third must be 0: every unsanctioned service has a stated data risk, because 'unapproved' on its own is not a finding anyone will act on. What can leave through it is.

Notes

The reason column is the one that changes outcomes. Shadow IT is the only entry on CompTIA's threat actor list with no malicious intent, and a discovery exercise that produces a block list without asking why people went there will be defeated by the next service they find.

This is an independent study companion for CompTIA Security+ SY0-701 and is not produced by or endorsed by CompTIA.