[Questions and Support] Suspicious Domain High False Positive

[zero77]

Question
I am getting a very high false positive for suspicious domains in particular domains ending in xyz, cc, ws

Is there any way i can disable suspicious ___domain detection for multiple clients

Looking through the trails it seems to be coming from the top part of this file which detects all domains ending with certain terms:

https://raw.githubusercontent.com/stamparm/maltrail/9dcfd0a4c0402feeae25ee00a288cf0d04840ce4/trails/static/suspicious/___domain.txt

Support

[MikhailKasimov]

Hello!

Try this option to use: https://github.com/stamparm/maltrail/blob/master/maltrail.conf#L132-L133

[zero77]

Thanks for your quick response, i am able to tune it out but i want to stop it from being detected altogether instead of constantly tuning it out.

Could the top part of the ___domain.txt be separated into a different file. So people can decide if they want to keep it as it's very broad and leads to false positives.

[MikhailKasimov]

Could the top part of the ___domain.txt be separated into a different file. So people can decide if they want to keep it as it's very broad and leads to false positives.

No problem to use different file with respective format: https://github.com/stamparm/maltrail/wiki/Maltrail-trails-base-format and use it as user-defined whitelist (https://github.com/stamparm/maltrail/blob/master/maltrail.conf#L126-L127).

[MikhailKasimov]

The second way (more global): is just to put # sign in front of ___domain you want to exclude. E.g. .cc --> # .cc, save /___domain.txt file and restart the /sensor.py. Downside of this method: you potentially can miss real malware/malicious connections to .cc-based domains.

[zero77]

Thanks for the suggestions, if i commented out .cc i would still detect known malicious cc domains right ?

[MikhailKasimov]

Thanks for the suggestions, if i commented out .cc i would still detect known malicious cc domains right ?

Known would stay detected.

[MikhailKasimov]

@zero77 Hello! Is the problem resolved?

[zero77]

I am trying to do this on multiple Linux servers with a script that i am using for updating maltrail.
The update part works but its not excluding the ___domain extensions i want to exclude and leave everything else untouched.

- name: Tune Domain Extensions
  lineinfile:
    path: /opt/maltrail/trails/static/suspicious/___domain.txt
    regexp: '{{item.From}}'
    line: '{{item.To}}'
    state: present
  with_items:
   - { From: '.cc', To: '#.cc'}
   - { From: '.xyz', To: '#.xyz'}
  changed_when: false
  ignore_errors: yes