ID | Technique | Tactic |
---|---|---|
T1048.003 | Exfiltration Over Unencrypted Non-C2 Protocol | Exfiltration |
T1048 | Exfiltration Over Alternative Protocol | Exfiltration |
Detection: DNS Query Length With High Standard Deviation
Description
The following analytic identifies DNS queries with unusually large lengths by computing the standard deviation of query lengths and filtering those exceeding twice the standard deviation. It leverages DNS query data from the Network_Resolution data model, focusing on the length of the domain names being resolved. This activity is significant as unusually long DNS queries can indicate data exfiltration or command-and-control communication attempts. If confirmed malicious, this activity could allow attackers to stealthily transfer data or maintain persistent communication channels within the network.
Search
1
2| tstats `security_content_summariesonly` count from datamodel=Network_Resolution where NOT DNS.record_type IN("Pointer","PTR") by DNS.query host
3| `drop_dm_object_name("DNS")`
4| eval tlds=split(query,".")
5| eval tld=mvindex(tlds,-1)
6| eval tld_len=len(tld)
7| search tld_len<=24
8| eval query_length = len(query)
9| table host query query_length record_type count
10| eventstats stdev(query_length) AS stdev avg(query_length) AS avg p50(query_length) AS p50
11| where query_length>(avg+stdev*2)
12| eval z_score=(query_length-avg)/stdev
13| `dns_query_length_with_high_standard_deviation_filter`
Data Source
Name | Platform | Sourcetype | Source |
---|---|---|---|
Sysmon EventID 22 | Windows | 'xmlwineventlog' |
'XmlWinEventLog:Microsoft-Windows-Sysmon/Operational' |
Macros Used
Name | Value |
---|---|
security_content_summariesonly | summariesonly= summariesonly_config allow_old_summaries= oldsummaries_config fillnull_value= fillnull_config`` |
dns_query_length_with_high_standard_deviation_filter | search * |
dns_query_length_with_high_standard_deviation_filter
is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Annotations
Default Configuration
This detection is configured by default in Splunk Enterprise Security to run with the following settings:
Setting | Value |
---|---|
Disabled | true |
Cron Schedule | 0 * * * * |
Earliest Time | -70m@m |
Latest Time | -10m@m |
Schedule Window | auto |
Creates Risk Event | True |
Implementation
To successfully implement this search, you will need to ensure that DNS data is populating the Network_Resolution data model.
Known False Positives
It's possible there can be long domain names that are legitimate.
Associated Analytic Story
Risk Based Analytics (RBA)
Risk Message | Risk Score | Impact | Confidence |
---|---|---|---|
A dns query $query$ with 2 time standard deviation of name len of the dns query in host $host$ | 56 | 70 | 80 |
Detection Testing
Test Type | Status | Dataset | Source | Sourcetype |
---|---|---|---|---|
Validation | ✅ Passing | N/A | N/A | N/A |
Unit | ✅ Passing | Dataset | XmlWinEventLog:Microsoft-Windows-Sysmon/Operational |
XmlWinEventLog |
Integration | ✅ Passing | Dataset | XmlWinEventLog:Microsoft-Windows-Sysmon/Operational |
XmlWinEventLog |
Replay any dataset to Splunk Enterprise by using our replay.py
tool or the UI.
Alternatively you can replay a dataset into a Splunk Attack Range
Source: GitHub | Version: 7