ID | Technique | Tactic |
---|---|---|
T1568.002 | Domain Generation Algorithms | Command And Control |
Detection: Detect suspicious DNS TXT records using pretrained model in DSDL
EXPERIMENTAL DETECTION
This detection status is set to experimental. The Splunk Threat Research team has not yet fully tested, simulated, or built comprehensive datasets for this detection. As such, this analytic is not officially supported. If you have any questions or concerns, please reach out to us at research@splunk.com.
Description
The following analytic identifies suspicious DNS TXT records using a pre-trained deep learning model. It leverages DNS response data from the Network Resolution data model, categorizing TXT records into known types via regular expressions. Records that do not match known patterns are flagged as suspicious. This activity is significant as DNS TXT records can be used for data exfiltration or command-and-control communication. If confirmed malicious, attackers could use these records to covertly transfer data or receive instructions, posing a severe threat to network security.
Search
1
2| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Network_Resolution where DNS.message_type=response AND DNS.record_type=TXT by DNS.src DNS.dest DNS.answer DNS.record_type
3| `drop_dm_object_name("DNS")`
4| rename answer as text
5| fields firstTime, lastTime, message_type,record_type,src,dest, text
6| apply detect_suspicious_dns_txt_records_using_pretrained_model_in_dsdl
7| rename predicted_is_unknown as is_suspicious_score
8| where is_suspicious_score > 0.5
9| `security_content_ctime(firstTime)`
10| `security_content_ctime(lastTime)`
11| table src,dest,text,record_type, firstTime, lastTime,is_suspicious_score
12| `detect_suspicious_dns_txt_records_using_pretrained_model_in_dsdl_filter`
Data Source
Name | Platform | Sourcetype | Source | Supported App |
---|---|---|---|---|
N/A | N/A | N/A | N/A | N/A |
Macros Used
Name | Value |
---|---|
security_content_ctime | convert timeformat="%Y-%m-%dT%H:%M:%S" ctime($field$) |
detect_suspicious_dns_txt_records_using_pretrained_model_in_dsdl_filter | search * |
detect_suspicious_dns_txt_records_using_pretrained_model_in_dsdl_filter
is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Annotations
Default Configuration
This detection is configured by default in Splunk Enterprise Security to run with the following settings:
Setting | Value |
---|---|
Disabled | true |
Cron Schedule | 0 * * * * |
Earliest Time | -70m@m |
Latest Time | -10m@m |
Schedule Window | auto |
Creates Risk Event | True |
Implementation
Steps to deploy detect suspicious DNS TXT records model into Splunk App DSDL. This detection depends on the Splunk app for Data Science and Deep Learning which can be found here - https://splunkbase.splunk.com/app/4607/
and the Network Resolution datamodel which can be found here - https://splunkbase.splunk.com/app/1621/
. The detection uses a pre-trained deep learning model that needs to be deployed in DSDL app. Follow the steps for deployment here - https://github.com/splunk/security_content/wiki/How-to-deploy-pre-trained-Deep-Learning-models-for-ESCU
.
- Download the
artifacts .tar.gz
file from the link -https://seal.splunkresearch.com/detect_suspicious_dns_txt_records_using_pretrained_model_in_dsdl.tar.gz
. - Download the
detect_suspicious_dns_txt_records_using_pretrained_model_in_dsdl.ipynb
Jupyter notebook fromhttps://github.com/splunk/security_content/notebooks
. - Login to the Jupyter Lab assigned for
detect_suspicious_dns_txt_records_using_pretrained_model_in_dsdl
container. This container should be listed on Containers page for DSDL app. - Below steps need to be followed inside Jupyter lab.
- Upload the
detect_suspicious_dns_txt_records_using_pretrained_model_in_dsdl.tar.gz
file intoapp/model/data
path using the upload option in the jupyter notebook. - Untar the artifact
detect_suspicious_dns_txt_records_using_pretrained_model_in_dsdl.tar.gz
usingtar -xf app/model/data/detect_suspicious_dns_txt_records_using_pretrained_model_in_dsdl.tar.gz -C app/model/data
. - Upload detect_suspicious_dns_txt_records_using_pretrained_model_in_dsdl.ipynb` into Jupyter lab notebooks folder using the upload option in Jupyter lab.
- Save the notebook using the save option in Jupyter notebook.
- Upload
detect_suspicious_dns_txt_records_using_pretrained_model_in_dsdl.json
intonotebooks/data
folder.
Known False Positives
False positives may be present if DNS TXT record contents are similar to benign DNS TXT record contents.
Associated Analytic Story
Risk Based Analytics (RBA)
Risk Message | Risk Score | Impact | Confidence |
---|---|---|---|
A suspicious DNS TXT response was detected on host $src$ , kindly review. | 45 | 50 | 90 |
References
Detection Testing
Test Type | Status | Dataset | Source | Sourcetype |
---|---|---|---|---|
Validation | Not Applicable | N/A | N/A | N/A |
Unit | ❌ Failing | N/A | N/A |
N/A |
Integration | ❌ Failing | N/A | N/A |
N/A |
Replay any dataset to Splunk Enterprise by using our replay.py
tool or the UI.
Alternatively you can replay a dataset into a Splunk Attack Range
Source: GitHub | Version: 2