Log in Request a demo

How To Defend

How To Respond To Misconfigurations And Takeover.

A misconfiguration alert means a setting on something you expose to the internet is risky. Examples are an open admin panel, an unneeded open service, weak TLS, missing email protection records, or a subdomain that can be taken over. First decide how fast an attacker could use it, then close or restrict it and recheck from outside.

  • Infrastructure
  • Raised by Misconfiguration Detection
Alert area
Infrastructure
Raised by
Misconfiguration Detection
First 24 hours
8 steps
Investigation
8 checks
Who acts
SOC analyst, IT admin, Network engineer and 4 more
Last updated October 9, 2026

What This Alert Means.

A misconfiguration alert means a setting is wrong or unsafe on something you expose to the internet. The alert covers exposed admin panels, open ports and services, weak TLS, missing SPF with DMARC set to none, and subdomain takeover. TLS is the encryption used by secure websites. SPF and DMARC are email records that say who may send mail as your domain. A subdomain takeover happens when a DNS record still points to a service you no longer use, so someone else can claim it.

The NCSC lists DNS weaknesses, certificate issues, email security gaps and outdated software among the misconfigurations that external scanning finds. Many are simple to fix, and anyone scanning from outside can find them.

First 24 Hours.

Sort the findings by how directly an attacker could use them. A dangling DNS record or a login panel open to anyone comes before a weak cipher.

Do now
  1. SOC analyst Open the alert from the Brandefense misconfiguration detection module and save each finding with the host, port, record and first-seen dateOne list for all findings
  2. IT admin Confirm each finding from outside your network with a fresh checkSome findings are fixed by the time you look
  3. IT admin Put exposed admin panels and management services behind a VPN, single sign-on or an IP allow listRemove public access first, improve it later
  4. Network engineer Close ports and services nobody can explainRecord who asked for them, if anyone
  5. DNS admin Find DNS records that point to services, cloud resources or hosting you no longer use and delete themThis stops a subdomain takeover
  6. Security lead Check admin accounts on any exposed panel for weak or default passwords and review recent loginsLook for logins from unfamiliar places
  7. Mail admin Publish or correct SPF and DMARC records for every domain you ownPlan the DMARC policy change in stages
  8. Legal Ask whether a takeover or an exposed panel with data triggers any notice dutiesCheck with your legal counsel

Investigation Checklist.

For each finding, ask whether it was already abused, not only whether it exists.

Check each finding
  • Was the admin panel reachable without a login, or with a default login?Anyone could have entered
  • Do logs show logins or changes from addresses you do not know?If yes, open an incident
  • Which service or provider does the dangling record point to?You must know where to claim or delete it
  • Did anyone already serve content on that subdomain?Search the web for pages under your name
  • Do any cookies or logins apply to the parent domain?A takeover of a subdomain may reach them
  • Which TLS versions and certificates does the host accept?Check for old versions and expired certificates
  • Which of your domains have no SPF, no DKIM or DMARC set to none?Parked domains count
  • Which software behind the open service is out of date?Add it to patching

Containment And Removal.

Most fixes are in your own systems. Where an attacker has already taken a name or a service, you need outside parties to remove it.

  • Your own DNS and cloud accounts: delete or correct the record, and claim or delete the resource it points to. MITRE notes that records pointing to non-existent or deprovisioned resources let attackers take over subdomains.
  • Cloud or hosting provider abuse contact: if someone else has claimed your subdomain on a platform, report it to that platform's abuse channel and show you control the parent domain.
  • Registrar abuse contact: if a domain tied to you was taken or changed, tell the registrar and ask it to lock the domain and restore your records.
  • Certificate authority: if a certificate was issued for a hijacked name, ask the issuer to revoke it.
  • National CERT: in Turkiye, report malicious pages to USOM (usom.gov.tr). In the US, use the FBI IC3 if money or data was lost.
  1. ConfirmRe-test from outside
  2. RestrictRemove public access
  3. FixPatch, correct or delete
  4. RecheckScan again and log it

Longer-Term Hardening.

Move from one-off fixes to defaults that stay fixed.

  • Use TLS 1.3 or TLS 1.2. The NCSC says TLS 1.1 and 1.0 have been deprecated by the IETF and all SSL versions must not be used, and advises disabling SSL versions, EXPORT ciphers and compression.
  • Protect every domain with SPF, DKIM and DMARC. The NCSC explains that DMARC sets how receiving servers handle mail that fails SPF or DKIM and produces reports that show how your mail is handled.
  • Keep management services off the internet. CISA notes that edge devices are attractive targets because of their reach into networks and links to identity systems.
  • Delete DNS records when a service is retired. Make it a step in every shutdown checklist.
  • Use a written baseline. Agree one standard configuration per service type and compare against it. Use a published hardening benchmark of your choice.
  • Test from outside on a schedule. The NCSC says to combine what tools find with your knowledge of how the business runs.

How To Measure That It Worked.

Count findings that stay fixed.

  • Open findings by type, and how many are older than your own target.
  • Admin panels and management ports reachable from the internet.
  • DNS records pointing to resources that no longer exist.
  • Domains with SPF, DKIM and a DMARC policy beyond none.
  • Hosts that accept only supported TLS versions.
  • Findings that return after a fix.

Common Mistakes.

These slow teams down or hide risk.

  • Fixing the weak cipher first and leaving the open admin panel.
  • Deleting the server but not the DNS record that points to it.
  • Moving DMARC to reject in one step without reading reports, which can block real mail.
  • Skipping SPF and DMARC on domains that send no email.
  • Marking a finding fixed without testing it from outside.
  • Never checking logs for use of the exposed service before the fix.

Questions.

  • What is a subdomain takeover?

    It happens when a DNS record points to a service or cloud resource you no longer use. Someone else can claim that resource and then serve content under your subdomain. MITRE describes this as adversaries taking over subdomains through dangling DNS records.

  • How do I fix a dangling DNS record?

    Find the record in your DNS zone, check which service it points to, and delete it if nothing needs it. If you still need the name, claim or recreate the resource first. Then test the subdomain from outside and check logs for earlier misuse.

  • Is an exposed admin panel really that serious?

    It can be. An admin panel open to the whole internet invites password guessing and use of known flaws. CISA treats internet-exposed edge devices as attractive targets. Restrict access with a VPN or an allow list, then review logins.

  • What does DMARC none mean?

    A DMARC policy of none only collects reports and does not tell receiving servers to block or quarantine failed mail. It is a good first step. The NCSC says DMARC lets you set a policy for mail that fails SPF or DKIM, so plan a move to a stricter policy.

  • Which TLS versions should I allow?

    The NCSC advises TLS 1.3 and TLS 1.2 with its recommended profiles, and says TLS 1.1 and 1.0 are deprecated and should not be used. Disable all SSL versions too, then test the host from outside.

Sources

  1. 1 NCSC: External attack surface management buyer's guide
  2. 2 NCSC: Using TLS to protect data
  3. 3 NCSC: Email security and anti-spoofing
  4. 4 MITRE ATT&CK: Compromise Infrastructure, Domains (T1584.001)
  5. 5 CISA: BOD 26-02, end-of-support edge devices

More Playbooks.

All Playbooks
Infrastructure Actively exploited vulnerabilities An exploited vulnerability alert means a flaw in software you may run has public exploit code or is already being used in attacks. Find every affected system first, starting with those open to the internet. Patch or reduce exposure, and check for signs of compromise both before and after you patch. Open Infrastructure Initial access listings An initial access listing means someone is selling a way into your network, such as VPN logins, a remote desktop session or a webshell. CISA notes that criminals who get into a network often sell that access to others. Treat it as a live intrusion risk: find which door the listing describes, close it, then hunt for any foothold already in place. Open Infrastructure Leaked databases and source code A data leak alert means a database, source code, configuration file or API key that looks like yours has been posted on a paste site or a dark web repository. Treat any secret in it as public. Confirm the material is real, then revoke and replace every key, password and token in it before you work out how it got out. Open

Keep Exploring.

Knowledge Hub
Glossary term Security Misconfiguration Security misconfiguration is a weakness caused by systems, software or cloud services being set up in an unsafe way. Open Glossary term DMARC, SPF And DKIM DMARC, SPF and DKIM are three email authentication standards that help a receiving mail system check whether a message really comes from the domain it claims. Open

Browse The Library.