ThreatOrigin

Blocking shows where a query was going. Find where it came from.

Behind every blocked query there are four origins: the domain that referred it, the path it spread along, the real device behind your DNS servers and the process that made it.

Four questions. One origin.

Blocking shuts the door. Four questions tell you who knocked.

09:41:09evil-cdn.exampleBLOCKED

WHY · THE REFERRER

Why did it go there?

WS-0142direct queryevil-cdn.exampleBLOCKED
no referring page
Direct. No referrer.Nothing the user browsed links to this domain. The device went there on its own.

How it is found: threat intelligence keeps a map of which domains link to which, and checks the domain visited just before the query.

Needs: DNS traffic, no agent

Illustrative scenarios. Device names, times, path and hash are examples.

FOUR ANSWERS. THAT IS THE ORIGIN.Malware is spreading. Start with WS-0142 and remove updater.exe.
A malicious process on a laptop, targeted by the ThreatOrigin mark like a scope, with its connection leading out to an attacker

Blocking stops the request. It doesn't stop the malware.

A DNS block hides the symptom while the cause stays in place. ThreatOrigin traces every blocked query back to its origin, so your team removes the cause, not only the request.

WHY · THE REFERRER

ThreatOrigin original

Why does this device keep reaching malware?

One device, hundreds of blocked queries. Is it infected, or is someone watching a film on a site whose scripts keep calling out in the background? ThreatOrigin shows whether each query was referred by another domain or went out directly. Referred: the site is sending it there. Direct: the device went on its own.

How it is found: threat intelligence keeps a map of which domains link to which, and checks the domain visited just before the query.

  • You see: referred by a domain, or direct
  • Needs: DNS traffic, no agent
  • In the product: Why Visited

chrome.exe on WS-0188 · blocked again and again

free-movies.examplescript on the page
  • coin-pool.exampleBLOCKED
  • beacon-cdn.exampleBLOCKED

Referred by free-movies.example. The site, not the device.

Illustrative example

WHERE · THE SPREAD PATH

Where did it start, and how did it spread?

A malicious domain is queried by a different machine every day. Somewhere it started. ThreatOrigin keeps the query history of every device, so it shows the day your company first reached the domain, the device that made that first query and each device that followed, in order. That order is the path the malware took inside your network.

How it is found: every query is kept with its history, per device and for the whole company.

  • You see: the first device, then each device in order, with dates
  • Needs: your query history, no agent
  • In the product: Firstly Visited

evil-cdn.example · spread path in your company

  1. 1st · WS-0142
    3 Nov
  2. 2nd · WS-0167
    4 Nov
  3. 3rd · WS-0203
    5 Nov
  4. 4th · WS-0118
    6 Nov

It started on WS-0142. Three devices followed.

Illustrative example

WHO · THE REAL DEVICE

One query, many logs. Who really asked?

In a large network one DNS query passes through several DNS servers, and each of them logs it. You see the same query many times, each time under a different server's address. You don't have to trace it by hand. ThreatOrigin reads those logs on premises, joins them into one path and names the device that really asked.

How it is found: DNS, DHCP and Active Directory logs are joined into one record: user, host name, IP and MAC address.

  • You see: the DNS path, and the real device at its start
  • Needs: Enterprise, on premises, no network change
  1. WS-0142
  2. DNS branch
  3. DNS HQ
  4. DNS edge
  5. Cloud

Three DNS servers logged the same query. The last address on it: DNS edge.

Three logs, one path, one device: WS-0142 · user21.

Illustrative example

WHAT · THE PROCESS

What made the query?

The device is known. What on it made the call? ThreatOrigin names the process behind the query, the parent process that started it, the file path and the hash, so the malware is removed, not only blocked. It works with or without an XDR.

How it is found: by an agent on the device, or by the XDR you already run. Which one depends on where your data lives.

  • You see: process, parent process, path, hash
  • Needs: agent (cloud) or your XDR (on premises)
  1. explorer.exe
  2. cmd.exe
  3. updater.exe
  4. evil-cdn.example
Parent
cmd.exe
Path
C:\Users\user21\AppData\Local\Temp\updater.exe
SHA-256
9f2c4e…b71a03
Illustrative example

Two ways to see the process

Chosen by where your data lives.

  • IN THE CLOUDWith the DNSEndpoint agentOn every query.
  • ON PREMISESThrough the XDR you already runEndpoint data stays inside your network.

One agent, two modes

  • MONITOR MODESee everything, touch nothing
  • ACTIVE PROTECTION MODEDetect it and stop it
  • One agent for every device
  • Windows and macOS
  • Choose the mode per device or per group

WHAT YOU GET

What ThreatOrigin tells you

Not four more columns in a log. A finding that says what happened, where it started and what to do.

  • No infection. A streaming site is the cause.

    Referrer
    free-movies.example
    Spread path
    One device. No path
    Real device
    WS-0188 · user34
    Process
    chrome.exe

    Block the site. Leave the device alone.

  • Malware is spreading inside your network.

    Referrer
    None. Direct queries
    Spread path
    WS-0142 on 3 Nov, then WS-0167, WS-0203, WS-0118
    Real device
    WS-0142 · user21
    Process
    updater.exe, started by cmd.exe

    Start with WS-0142. Remove updater.exe on all four devices.

Illustrative findings

What each origin needs

The referrerFOUND FROMThe domain link map in threat intelligenceNEEDSDNS traffic. No agent.
The spread pathFOUND FROMYour query history, per device and companyNEEDSDNS traffic. No agent.
The real deviceFOUND FROMYour DNS, DHCP and Active Directory logsNEEDSRuns on premises. No network change.
The processFOUND FROMThe DNSEndpoint agent, or the XDR you already runNEEDSCloud: agent on Windows and macOS. On premises: a supported XDR.

There's more to discover !

Sensei

Hey, I'm Sensei

I can walk you through everything about finding the origin. What's on your mind?

ThreatOrigin

Find the Origin Behind Every Threat

©️ ThreatOrigin, 2026. All Rights Reserved