In this article, you will learn everything you need to know about the DNS Security - Endpoint module. DNS Security - Endpoint is based on the DarkLayer Guard engine, the world’s most advanced endpoint DNS threat hunting tool, and boasts our Threat to Process Correlation technology, allowing you to spot processes, users, URLs, and attacker origins used to infiltrate your network. DNS Security - Endpoint makes the DarkLayer Guard - Endpoint work in tandem with our VectorN Detection AI-based traffic pattern recognition engine to also give you HIPS/HIDS and IOA/IOC capabilities and spot hidden malware, completely autonomous of code and signatures.
1. Description
2. How does DNS Security - Endpoint work?
3. HEIMDAL Agent - DarkLayer Guard
4. DNS Security - Endpoint view
5. DNS Security - Endpoint settings
DESCRIPTION
DNS Security - Endpoint is responsible for filtering all network packets based on the DNS request origin and destination. It replaces the manual or DHCP-set DNS values with IP Addresses from the Client Host IP Address range, thus effectively telling the computers to resolve the DNS requests themselves. The original DNS values from the network card settings are not lost but are saved under GUIDs in the Windows Registry and used when DNS requests are made towards internal resources (print servers, local file servers, or anything that has a private IP Address assigned) or external resources. The traffic filtering engine blocks malicious packets from communicating across the network, prevents man-in-the-browser attacks, detects zero-hour exploits, protects from data or financial exfiltration, prevents data loss or network infections, and detects local DNS hijacking/poisoning.
DNS Security - Endpoint blocks malicious websites by making sure that users do not establish untrusted connections. If a connection is made, an attacker is able to open backdoors into a PC by using zero-day exploits or by executing remote shellcodes. The module also makes sure that data is not automatically filled into online forms belonging to fraudulent websites.
- An example of how DNS Security - Endpoint protects users from financially exploiting malware (banking trojans) can be seen below:
The DarkLayer Guard - Endpoint filter receives more than 800.000 new weekly updates to keep up with cybercriminals’ threats. A filter update is provided every 2 hours. The update is based on a wide range of data, including newly registered domain names, reverse-engineering of advanced malware, monitoring of criminal network sinkholes, and data gathered during e-crime analysis. This insight into cybercrime enables Heimdal to block data from a PC or network from being sent to a hacker-controlled server, therefore protecting corporate or personal data from exfiltration.
Heimdal does not share a full repository of the DNS detections due to the tremendous data volume of the AI Predictive DNS; hence, VirusTotal will not necessarily show the Heimdal detection. You will need to use the Investigate mode in the HEIMDAL Dashboard.
HOW DOES DNS SECURITY - ENDPOINT WORK?
On Windows, when DNS Security - Endpoint is enabled, the DarkLayer Guard - Endpoint engine creates a local DNS Server that acts as a filtering engine before resolving the user's DNS Query. The DarkLayer Guard DNS Server hijacks the DNS IP Address on the active Network Adapter(s) to scan for malicious websites and other web locations (servers, online ads, etc) that can potentially install malware or be used as gateways for cyberattacks.
The DarkLayer Guard - Endpoint engine will change the DNS (Domain Name System) IP Addresses on IPv4 and IPv6.
- On IPv4, it will change your DNS IP Address from Obtain DNS server addresses automatically (set by DHCP) or from an already set static DNS IP Address to 127.7.7.x (the DarkLayer Guard DNS IP Address). Your initial DNS IP Address will be backed up in the Windows Registry to be used to resolve DNS Queries after being allowed.
- On IPv6, it will change your DNS IP Address from Obtain DNS server addresses automatically (set by DHCP) or from an already set static DNS IP Address to fe80::xxxx:yyyy:xxxx:zzzz (the DarkLayer Guard DNS IP Address). Your initial DNS IP Address will be backed up in the Windows Registry to be used to solve the DNS Queries after being allowed.
Once the DNS IP Address is set, every web location you access via the Internet will be processed through a database that is set locally in the HEIMDAL Agent installation path. This database is about 15 MB in size, and 95% of the websites blocked are located here.
If the website is identified as being infected, the DarkLayer Guard - Endpoint engine will block it, and you will see this block page (in the browser):
Additionally, if you perform nslookup on a malicious domain, the resolving IP Address will be tpeblockserver.trafficmanager.net / 20.86.55.232 (our HEIMDAL Security block page). If the website is not blocked after being processed through the local database, it will pass, but there is a second step. The website will be parsed through another database, in the cloud (about 6GB in size), where it will be checked again. If it’s found to be malicious, DarkLayer Guard - Endpoint will block it. If it’s safe, you’ll just be able to access the website normally.
Note: All this filtering process takes place in milliseconds and will not affect your internet connection speed.
HEIMDAL AGENT - DARKLAYER GUARD
The HEIMDAL Agent displays information about the Prevented Attacks, the Targeted Processes, and the VectorN Detections.
When enabled, whenever a malicious domain is queried, a pop-up window will be shown to the user. Engaging the Click for the full details will redirect the user to the HEIMDAL Agent in the DNS Security - DarkLayer Guard view.
The information displayed on the HEIMDAL Agent - DNS Security section is reported to the HEIMDAL Dashboard - DNS Security - Endpoint view.
DNS SECURITY - ENDPOINT VIEW
The DNS Security - Endpoint view displays all the information collected by the HEIMDAL Agent that is running on the endpoints in your organization. The collected information refers to the DNS queries that are filtered by the HEIMDAL Agent's DarkLayer Guard engine. At the top, you see a statistic regarding the number of Analyzed Traffic Requests, the number of Prevented Attacks, the percentage of Prevented Attacks, and the number of Category Blocks. You can navigate between multiple pre-filtered views to quickly and easily access the information that you need to process to analyze and remediate potential vulnerabilities.
The collected information is placed in the following views: Standard, Category Blocks, Manual Blocklist, Allowlist Request, Full Logging, Investigate, and CASB.
-
Standard
The Standard view is a complete overview of the total analyzed requests (the total DNS requests intercepted by the HEIMDAL Agent (whether they are blocked or allowed), prevented attacks (any threat intelligence blocks like malware, phishing, C2C servers, etc.), and manually blocked domains (domains blocked based on the entries in the group policies' blocklist), as well as a pre-calculated risk level for your device. All entries are identified by hostname, username, and IP address. The calculated risk score is based on the time frame selected in the HEIMDAL Dashboard and offers a great way to visualize and measure the impact of your awareness training and security procedures that you facilitate in your organization, as you can track the changes in your high-risk users' behavior over time.
The data in this view can be filtered by the following filters you can access in the dropdown menu: Standard, Threat Type, Domain/Hits(blocks), Hostname/Threats, Latest Threats, Forensics, and TTPC. You can also filter the grid entries by the Group Policy applied to the listed endpoints. -
Category Blocks
Category Blocks are policy rules that intercept and stop DNS resolution requests based on the pre-classified classification (category) of the destination domain. These prevent users from accessing specific website categories like Gambling, Social Media, or Adult Content.
The Category Blocks view presents a consolidated overview of all hits to the preset Category Filters. This view makes it easy to manage chosen Categories, get a visualization of their impact, and identify users with online behavior that does not match the organization. -
Manual Blocklists
The view will show domains blocked by the Heimdal Agent, based on the entries set in the domain blocklist and the Application Blocklist within the group policy. -
Allowlist Requests
The Allowlist Requests shows all access requests to blocked domains awaiting administrator action. Approving the request will allow you to add the domain to the allowlist in both the group policy for the DNS Security - Endpoint module and the Network settings for the DNS Security - Network module. The Pending approval filter displays all requests awaiting administration action (approve or deny).
The History filter displays all previously processed requests, including both approved and denied entries. -
Full Logging
This view is an aggregated view that lists all endpoints that registered interceptions in the selected timeframe, with all their allowed requests and prevented attacks. -
Investigate
This view allows you to get DNS-related statistics on any domain you input in the search field. The view is split into 3 subsections:
a. Global Threat Intelligence - displays a top 3 of most accessing processes, the DNS-E matches (the number of times, in the selected timeframe, the domain has been intercepted via DNS-E), the Global DNS-E matches (the number of times, in the selected timeframe, the domain has been intercepted by DNS-E in the Global Heimdal Security database), the domains/URLs related to the same IP Address, the DNS-E + DNS-N matches (the number of times, in the selected timeframe, the domain has been intercepted by DNS-E and DNS-N), the Global DNS-E + DNS-N matches (the number of times, in the selected timeframe, the domain has been intercepted by DNS-E and DNS-N in the Global Heimdal Security database).
b. Predictive DNS Score - displays a maliciousness score based on an Artificial Intelligence algorithm (ranging from 0 to 100) that is corroborated with the presence of the domain (in question) on the DNS Security Endpoint blocklist (blocklist match). The higher the score, the higher the probability that the domain in question is infected. The Predictive DNS Score will showcase a Risk Level (None, Low, Medium, High, Critical) based on the above-mentioned score.
c. DNS Statistics - displays a graphical representation of the daily number of hits for the chosen domain (the blue line shows that the queried domain was found clean at the time of the query, while the red line shows that the queried domain was found infected at the time of the query.
d. Requester distribution - displays a map and statistics of the top public IP Addresses that called the domain in question (the origin of the DNS query to the domain in question). -
CASB
This view displays a list of the applications discovered by the DarkLayer Guard engine in your environment and the following details: Application Name, Vendor, Installed Endpoints, and Risk Level. CASB can be used as a cloud access security broker (CASB) that provides a comprehensive set of capabilities to help you manage and control the use of cloud apps across your organization - including visibility into inappropriate cloud app usage.
The selection column allows you to select one or multiple applications and add/remove them to/from the Application blocklist.
The Download CSV functionality allows you to generate and download a CSV report that includes all the information in Standard or Verbose mode corresponding to each view.
The Filters functionality allows you to filter entries by Operating System.
DNS SECURITY - ENDPOINT SETTINGS
By enabling the DarkLayer Guard engine, the Heimdal Agent will enable the network filter that will protect the computer from accessing malicious domains or URLs.
Note: Some of the options described below are only visible when Advanced mode is enabled in the Group Policy editor.
DarkLayer Guard™ - turns the DarkLayer Guard DNS filtering module ON or OFF.
General Settings
VectorN Detection - turns the VectorN Detection engine ON or OFF (this requires the DarkLayer Guard module to be enabled as well). VectorN Detection identifies both known and undiscovered malware attacks by analyzing communication patterns in your outgoing and incoming Internet traffic. It searches for patterns within the DarkLayer Guard domain blocks, such as a domain being blocked multiple times a day in a very short period, a domain being blocked every day at a specific time, or multiple domains being blocked in a very short amount of time.
DarkLayer Guard toast notification on blocked domain - displays a brief on-screen notification to the end user when DarkLayer Guard blocks a malicious domain.
Full logging of allowed and blocked DNS requests - retrieves enriched information on the DNS requests (allowed and blocked DNS queries) made from the endpoints. All DNS requests made in your environment will be logged, and the data is used for the CASB view.
Improve TTPC accuracy - installs and configures the Sysmon Windows add-on (if not installed already) to collect detailed DNS request information and improve the interception of processes that perform malicious DNS requests. If Sysmon is already in use on the endpoint, its configuration will be changed/updated by the Heimdal Agent, which may cause a conflict for this functionality. This option is only visible in Advanced mode.
- You can find the Sysmon logs in Event Viewer Logs - Application and Service Logs - Microsoft - Windows - Sysmon - Operational. The Event ID used for DNS request logging is 22.
- When the DarkLayer Guard - Endpoint engine gets the process ID from Sysmon and queries the Windows processes, there is a risk that the process was already killed or stopped. If this happens, DarkLayer Guard - Endpoint will not be able to get the process information, so a generic "-" will be displayed in the Heimdal Dashboard.
- There is a 2-minute wait time when the same domain is accessed, and this will result in displaying only one entry for that specific domain, even if it was accessed several times in that time interval. In the Event Viewer Logs, an entry will show up every time a domain is accessed.
Force NCSI fix - resolves instances where the Windows Network Connectivity Status Indicator (NCSI) incorrectly displays "No Internet Access" (the globe icon) in the System Tray while DarkLayer Guard is active. The Heimdal Agent sets the value 1 (default is 0) on the path Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NlaSvc\Parameters\Internet\EnableActiveProbing, and adds a Microsoft IP address in the hosts file (C:\Windows\System32\drivers\etc). This option is only visible in Advanced mode.
DarkLayer Guard check interval [minutes] - sets the interval (between 1440 and 2880 minutes) the DarkLayer Guard engine uses to automatically check for new definitions in the filtering database. This option is only visible in Advanced mode.
Compatibility Settings
DNS over HTTPS compatibility - prevents browsers (Google Chrome and Mozilla Firefox) from using DNS over HTTPS (DoH), which would bypass the more comprehensive DNS traffic filtering provided by Heimdal DNS Security. This ensures that all DNS requests are processed by DarkLayer Guard.
DNS over HTTPS server - allows you to specify a DoH domain or IP address in the field below the option, to be used by the DarkLayer Guard engine as a DNS server. The DoH server resolves DNS queries securely via encrypted communication and filters traffic only when the computer is outside of the organization's network/environment. When a computer is locally connected to the domain or via VPN, the DNS over HTTPS server will not filter the traffic, but will resolve it with the internal DNS IP address. Usually, DoH servers use different IP addresses depending on the location, but the common practice is that DoH servers can be identified by DNS name (which is the same).
Cisco AnyConnect/Fortinet VPN interception - automatically detects Cisco AnyConnect and Fortinet virtual adapters and ensures DarkLayer Guard continues to intercept and filter DNS traffic through them. It reroutes traffic from IPv6 to IPv4 on the VPN adapter to solve a known issue with Cisco AnyConnect/Fortinet IPv6 filtering.
Pause DarkLayer Guard™ when certain VPNs are detected - pauses the DarkLayer Guard engine while the endpoint is connected to a supported VPN, to avoid network compatibility issues. DNS filtering automatically re-enables after disconnecting from the VPN. Supported VPNs: Cisco AnyConnect, Fortinet, Juniper, PANGP, Sophos, Viscosity, and P81/Harmony SASE.
Disable DarkLayer Guard on IPv6 - disables DarkLayer Guard filtering for IPv6 traffic, ensuring compatibility in environments where full IPv6 DNS interception may cause conflicts (for example, with Cisco AnyConnect).
DNS server prioritization - allows DarkLayer Guard to optimize and ensure consistent DNS resolution. The engine continuously monitors the configured DNS servers, automatically reprioritizing them based on response speed and seamlessly switching to an available server if one fails to respond (the 1st DNS server is swapped with the 2nd one until the 1st one is up and running again).
PPP Adapter DNS interception - ensures DarkLayer Guard continues to filter DNS traffic even when routed through PPP adapters created by specific VPN products. Enabling this option automatically enables Cisco AnyConnect/Fortinet VPN interception and Use VPN forwarders as prerequisites.
Use VPN forwarders - makes the DarkLayer Guard engine use the DNS server addresses provided by the active VPN connection on all the network adapters of the endpoint, centralizing DNS resolution through the VPN tunnel.
Force DHCP DNS usage - sets the DNS on the Network Interface Card(s) to Automatic (DHCP) behind the DarkLayer Guard engine. If the DarkLayer Guard engine fails to add 127.7.7.x or fe80::yyyy:yyyy:xxxx:xxxx on the NIC(s), it will revert to automatic DNS (served by the DHCP). By default, this option is disabled, and DarkLayer Guard should work just fine on any type of computer. It is recommended only if you use a VPN product/service that resets the DNS IP address (after disconnecting) and sets the DNS to Obtain DNS server address automatically on the NIC.
This option is NOT recommended if:
- You use static DNS IP address(es) on your NIC;
- You are applying it to a Domain Controller/DNS Server.
Use default loopback address - tells DarkLayer Guard to set the DNS on the Network Interface Card(s) to 127.0.0.1 instead of 127.7.7.x (for IPv4) and ::1 instead of fe80::yyyy:yyyy:xxxx:xxxx (for IPv6). This forces the DarkLayer Guard engine to intercept traffic through a single loopback adapter. This setting helps ensure compatibility between DNS Security - Endpoint and certain VPN products, as well as other software you may use, such as virtualization products.
Content Filtering Settings
Allowlist - allows the Heimdal Dashboard Administrator to define exceptions to the DarkLayer Guard interceptions. Any domain explicitly added to this list will be permitted, even if it is flagged by DarkLayer Guard's threat intelligence. You can allowlist domains, subdomains, top-level domains (com, co.uk, etc.), or multiple domains at once by importing a .txt, .csv, .xls, or .xlsx file (when saving an Excel workbook/sheet as a CSV file, the domains/subdomains are automatically delimited by a comma [,] and they need to be listed on the same row; you can download a sample CSV file here). Existing entries can be searched and exported using the Download Allowlist domains .csv button.
Allowlist request - allows end users to request a domain allowlist directly from the Heimdal default block page or the custom one, while IT Admins receive and manage these requests directly from the Heimdal Dashboard. When enabled, an internal approval request form is embedded into the block page, and end users will see a Request Unblock button. Clicking this button allows them to submit a request (with an optional justification) that is routed to the internal IT team. These requests are centralized in the Heimdal Dashboard under DNS Security - Allowlist requests for review, where an Administrator can manually approve or deny them.
When disabled, the block page will instead display a Website reanalysis request button. This action submits the domain directly to Heimdal Customer Support for a global intelligence evaluation to determine if the domain should be reclassified.
Require allowlist reason - this sub-option becomes available when Allowlist request is enabled. When enabled, end users are required to justify (up to 100 characters) when submitting an unblock request. This mandatory reasoning is then displayed alongside the request in the Heimdal Dashboard, providing administrators with the necessary context for a more efficient review and approval process.
Note: Changes to the Allowlist request settings in the Group Policy are applied by a scheduled job that runs every 30 minutes. For example, if both Allowlist request and Require allowlist reason are enabled, and Require allowlist reason is then disabled, the change will not take effect immediately. It will be applied the next time the scheduled job runs, which may take up to 30 minutes.
Blocklist - allows the Heimdal Dashboard Administrator to explicitly prohibit access to specific domains that Heimdal DNS Security - Endpoint does not consider a threat. Any domain added to this list will be blocked by DarkLayer Guard. You can blocklist domains, subdomains, top-level domains (.com, .co.uk, etc.), or multiple domains at once by importing a .txt, .csv, .xls, or .xlsx file (the same CSV format and sample file as for the Allowlist apply). Existing entries can be searched and exported using the Download Blocklist domains .csv button.
Application blocklist - implements Cloud Access Security Broker (CASB) control over specific cloud applications, allowing you to block applications from accessing their underlying servers to manage shadow IT, enforce compliance, and prevent unauthorized data flows. The list is populated when you add an application from the CASB view, and each application can be blocked by ticking the Block application checkbox in the grid. Because it relies on the blocking mechanism of DNS-E, this option can only be enabled when Blocklist is enabled, and its rules are not applied if the Blocklist is disabled. The Allowlist takes precedence over any blocklist: if a domain or application domain is blocked in the Application blocklist and/or a blocked category, but is also added to the Allowlist, the domain will be allowed, and the end user can access it.
Category blocking - blocks access to domains based on their content category (examples: Social Networking, Sports, Gambling, Finance, Health, Keeping Children Safe in Education, and others). Select one or multiple categories from the list that appears when the option is enabled:
Category blocking schedule - available only when Category blocking is enabled, this option allows you to schedule specific time intervals when the selected categories are blocked. You can choose between Choose week day (select one or more days from Monday to Sunday) and Choose day of month (select one or more days from 1 to 31), set the Time Interval on the two-handle slider (00:00 to Midnight, with a minimum window of 2 hours), and select whether the blocking is Active during time selection or Inactive during time selection.
Custom block page - replaces the default Heimdal block page with your own personalized page when DNS Security - Endpoint intercepts and blocks access to a malicious (or blocklisted) domain. When enabled, you can enter your Organization's name, craft a personalized Block page message with simple text (no HTML or CSS tags), and Import Logo (.jpg, .png, .bmp). The maximum allowed size for the logo is 1 MB (300 x 300 pixels); exceeding this size will prompt you with an error. Use the Preview html button to see the resulting block page after saving the Group Policy.
HTTPS block page certificate installation - allows DarkLayer Guard to display the Heimdal or custom block page for HTTPS websites. This will automatically install the required certificate on all machines applying the respective Group Policy.
IMPORTANT
Do not use the DarkLayer Guard - Endpoint engine in combination with another DNS traffic scanning application because they might conflict with each other, and neither of them will work correctly. We recommend that you disable other traffic scanning applications installed locally before you enable Heimdal's DarkLayer Guard engine.