Detection: Excessive Usage of NSLOOKUP App

 1
 2| tstats `security_content_summariesonly` count as numNsLookup min(_time) as firstTime max(_time) as lastTime values(Processes.action) as action values(Processes.original_file_name) as original_file_name values(Processes.parent_process_exec) as parent_process_exec values(Processes.parent_process_guid) as parent_process_guid values(Processes.parent_process_name) as parent_process_name values(Processes.parent_process_path) as parent_process_path values(Processes.process) as process values(Processes.process_exec) as process_exec values(Processes.process_guid) as process_guid values(Processes.process_hash) as process_hash values(Processes.process_id) as process_id values(Processes.process_integrity_level) as process_integrity_level values(Processes.process_path) as process_path values(Processes.user_id) as user_id values(Processes.vendor_product) as vendor_product values(Processes.parent_process) as parent_process values(Processes.process_name) as process_name values(Processes.parent_process_id) as parent_process_id values(Processes.user) as user from datamodel=Endpoint.Processes where Processes.process_name = "nslookup.exe" by Processes.dest _time span=1m 
 3| `drop_dm_object_name(Processes)` 
 4| eventstats avg(numNsLookup) as avgNsLookup, stdev(numNsLookup) as stdNsLookup, count as numSlots by dest 
 5| eval upperThreshold=(avgNsLookup + stdNsLookup *3) 
 6| eval isOutlier=if(numNsLookup > 20 and numNsLookup >= upperThreshold, 1, 0) 
 7| search isOutlier=1 
 8| `security_content_ctime(firstTime)` 
 9| `security_content_ctime(lastTime)` 
10| `excessive_usage_of_nslookup_app_filter`