AdGuard Home
Free · OSSDNS
The DNS query log is your cheapest, highest-signal IOC hunt.
AdGuard Home homepage ↗Self-hosted DNS sinkhole. Blocks tracker and malware domains for everyone on your network, and gives you the query log — invaluable for IOC hunting when someone says "is this domain bad?"
What it watches
- DNS queries to malware / phishing / tracker domains (blocked + allowed)
- Newly-seen or algorithmically-generated domains (DGA patterns)
- Lookups matching your IOC feeds
- DNS-over-HTTPS bypass attempts
- Per-client query-volume spikes
MITRE ATT&CK coverage
Tactics this connector gives CyberCLI visibility into.
Every alert this connector surfaces
2 event types
Every matrix-covered event_type on the passthrough lane — pinned by the engine's coverage matrix.
The right column shows the operator-friendly phrase the dashboard renders. High-severity
AI-lane signals are summarized in What it watches above (Warden + Herald
handle those); the rest take the substrate's passthrough lane (no AI tokens burned).
| event_type | dashboard renders |
|---|---|
| dns_query | DNS query on adguard |
| dns_block | DNS query blocked on adguard |
What it helps you catch
What you'd see in CyberCLI
illustrativeBlocked DNS lookup to known-malware domain from WORKSTATION-7
- client
- 10.0.0.57 · WORKSTATION-7
- query
- x9k2c2[.]badactor[.]ru
- list
- Malware/C2 feed
- result
- blocked
Routed to Warden (triage) → Knight (detection) → Scribe (record)
Suggested Investigate the client for infection · find the process that resolved it (needs approval)
⛓ every step hash-chained · replayable
What CyberCLI reads from AdGuard Home
audit our mathAdGuard logs every DNS query the network makes — answered, blocked by filter, blocked by safesearch, or blocked by parental controls. The 20 fields we read carry: who asked (client IP, hostname, MAC), what was asked (qname, qtype), what was answered, which filter matched if any, and the upstream that resolved it. Foundational telemetry for spotting DGA, beaconing, and DNS-based C2.
Full field index · 20 fields ↓
.action.answer_b64.block_filter_list_id.block_reason.block_rule.client_ip.cybercli_class.cybercli_low_signal.cybercli_parse_status.cybercli_wire_format.elapsed_ms.elapsed_ns.event_id.event_timestamp.event_type.query_class.query_name.query_type.rule_level.upstream MITRE techniques typically mapped
- T1071.004 ↗
DNS C2Command and Control
- T1568 ↗
Dynamic ResolutionCommand and Control
- T1568.002 ↗
Domain Generation AlgorithmsCommand and Control
- T1048 ↗
Exfiltration Over Alternative ProtocolExfiltration
Trust Ladder ceiling · L0 → L3
- ·L0–L2: digest unusual-domain alerts, notify, summarize DNS patterns for the case
- ·L3 (Knight verification): reputation lookup on the queried domain, decode DGA candidates
- ·L4+: adding network-wide DNS filter rules (operator-owned policy surface)
Full ladder semantics · /trust →
Field count + sample event auto-derived from src/cybercli/connectors/adguardhome/vector.vrl at build time. Numbers update the moment the engine's parser changes — no drift.
Close more of the kill chain
AdGuard Home covers 2 of 14 ATT&CK tactics. Pair it with these to widen coverage:
How to connect
- 1 Point your network's DNS at AdGuard Home (DHCP option 6, or per-device).
- 2 Enable query logging in AdGuard.
- 3 Run `cybercli onboard adguard` and point it at the AdGuard API.
- 4 Confirm the query stream in the dashboard's Connectors panel.
curl -s -S -L https://raw.githubusercontent.com/AdguardTeam/AdGuardHome/master/scripts/install.sh | sh -s -- -v
Fully local. AdGuard resolves + logs on your hardware; CyberCLI reads the query log in-network — your browsing never leaves your environment.