Detection: DNS Query Length With High Standard Deviation

Updated Date: 2026-01-22 ID: 1a67f15a-f4ff-4170-84e9-08cf6f75d6f5 Author: Bhavin Patel, Splunk Type: Anomaly Product: Splunk Enterprise Security

Description

The following analytic identifies DNS queries with unusually large lengths by computing the standard deviation of query lengths and filtering those exceeding two times the standard deviation. It leverages DNS query data from the Network_Resolution data model, focusing on the length of the domain names being resolved. This activity is significant as unusually long DNS queries can indicate data exfiltration or command-and-control communication attempts. If confirmed malicious, this activity could allow attackers to stealthily transfer data or maintain persistent communication channels within the network.

Search

 1 
 2| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Network_Resolution where NOT DNS.record_type IN ("Pointer","PTR","SOA", "SRV") DNS.query != *. by DNS.answer DNS.answer_count DNS.query DNS.query_count DNS.reply_code_id DNS.src DNS.vendor_product DNS.dest DNS.record_type 
 3| `drop_dm_object_name("DNS")` 
 4| `security_content_ctime(firstTime)` 
 5| `security_content_ctime(lastTime)` 
 6| eval tlds=split(query,".") 
 7| eval tld=mvindex(tlds,-1) 
 8| eval tld_len=len(tld) 
 9| search tld_len<=20 
10| eval query_length = len(query) 
11| table firstTime lastTime src dest query query_length record_type count record_type 
12| eventstats stdev(query_length) AS stdev avg(query_length) AS avg p50(query_length) AS p50 
13| where query_length>(avg+stdev*2) 
14| eval z_score=(query_length-avg)/stdev 
15| stats count values(query) as query values(dest) as dest avg(query_length) as avg_query_length values(record_type) as record_type min(firstTime) as firstTime latest(lastTime) as lastTime by src 
16| `dns_query_length_with_high_standard_deviation_filter`

Data Source

Name	Platform	Sourcetype	Source
Sysmon EventID 22	Windows	`'XmlWinEventLog'`	`'XmlWinEventLog:Microsoft-Windows-Sysmon/Operational'`

Macros Used

Name	Value
security_content_ctime	`convert timeformat="%Y-%m-%dT%H:%M:%S" ctime($field$)`
dns_query_length_with_high_standard_deviation_filter	`search *`

dns_query_length_with_high_standard_deviation_filter is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Annotations

- MITRE ATT&CK

+ Kill Chain Phases

+ NIST

+ CIS

- Threat Actors

ID	Technique	Tactic
T1048.003	Exfiltration Over Unencrypted Non-C2 Protocol	Exfiltration

Actions on Objectives

DE.AE

CIS 13

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Setting	Value
Disabled	true
Cron Schedule	`0 * * * *`
Earliest Time	`-70m@m`
Latest Time	`-10m@m`
Schedule Window	`auto`
Creates Risk Event	True

This configuration file applies to all detections of type anomaly. These detections will use Risk Based Alerting.

Implementation

To successfully implement this search, you will need to ensure that DNS data is populating the Network_Resolution data model.

Known False Positives

It's possible there can be long domain names that are legitimate.

Associated Analytic Story

Risk Based Analytics (RBA)

Risk Message:

Potentially suspicious DNS query [$query$] with high standard deviation from src - [$src$]

Risk Object	Risk Object Type	Risk Score	Threat Objects
src	system	30	query

Detection Testing

Test Type	Status	Dataset	Source	Sourcetype
Validation	✅ Passing	N/A	N/A	N/A
Unit	✅ Passing	Dataset	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`	`XmlWinEventLog`
Integration	✅ Passing	Dataset	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`	`XmlWinEventLog`

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub | Version: 12