DEF CON 33 - BiC Village - Following Threat Actors Rhythm to Give Them More Blues - Malachi Walker
Source: YouTube · DEFCONConference · published Oct 22, 2025 · 37:11
[BLUF: The video introduces a DNS scavenger hunt to teach incident responders how to detect malicious infrastructure through domain patterns, emphasizing DNS as an early warning system in threat hunting.]2:00
Key Takeaways:
• DNS records like TXT and MX can reveal early signs of malicious activity, such as email-related domains and hidden strings 2:30.
• Threat actors often reuse infrastructure and leave behind patterns; analyzing these helps identify connections across domains 5:00.
• A step-by-step DNS hunt leads from clue.mmyailythreat.com to a final clue via text records, MX, CNAME, and base64 decoding 9:00.
• The final clue is a song reference to "This Is How We Do It" by Montel Jordan, confirming the hunt’s completion 22:10.
[DNS analysis enables proactive threat hunting by uncovering hidden patterns and connections, giving defenders a strategic edge over threat actors who rely on temporary, reusable infrastructure. The session encourages using free tools and LLMs to build scalable, cost-effective security workflows.]
Sources:
- 2:00 Introduction to domain intelligence and DNS as a first sign of trouble
- 2:30 Discussion of TXT and MX records revealing malicious patterns
- 5:00 Analysis of infrastructure reuse and domain convergence
- 9:00 Step-by-step DNS scavenger hunt progression
- 22:10 Final clue revealed through song reference
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
I am pleased to introduce Malachi Walker, a security adviser at domain tools, a trusted voice in the world of threat intelligence. With a background that spans cyber security program development, DNS infrastructure analysis, and cyber crime investigation, Malachi brings a sharp lens to understanding and countering malicious online infrastructure. Today's talk, following threat actors rhythm to give them more blues, introduces a new approach called domain intelligence analysis. You'll learn how threat actors operate in patterns and how DNS artifacts can provide early warning signs and actionable intelligence with examples from recent research reports. We will go through strategies that can make your incident response fa faster and more effective. Please join me in welcoming Malachi Walker. …