Detection: Detect hosts connecting to dynamic domain providers

Updated Date: 2025-05-02 ID: a1e761ac-1344-4dbd-88b2-3f34c912d359 Author: Bhavin Patel, Splunk Type: TTP Product: Splunk Enterprise Security

Description

The following analytic identifies DNS queries from internal hosts to dynamic domain providers. It leverages DNS query logs from the Network_Resolution data model and cross-references them with a lookup file containing known dynamic DNS providers. This activity is significant because attackers often use dynamic DNS services to host malicious payloads or command-and-control servers, making it crucial for security teams to monitor. If confirmed malicious, this activity could allow attackers to bypass firewall blocks, evade detection, and maintain persistent access to the network.

1
2| tstats `security_content_summariesonly` count min(_time) as firstTime from datamodel=Network_Resolution by DNS.answer DNS.answer_count DNS.query DNS.query_count DNS.reply_code_id DNS.src DNS.vendor_product 
3| `drop_dm_object_name("DNS")` 
4| `security_content_ctime(firstTime)` 
5| `dynamic_dns_providers` 
6| `detect_hosts_connecting_to_dynamic_domain_providers_filter`

Data Source

Name Platform Sourcetype Source
Sysmon EventID 22 Windows icon Windows 'xmlwineventlog' 'XmlWinEventLog:Microsoft-Windows-Sysmon/Operational'

Macros Used

Name Value
dynamic_dns_providers `lookup update=true dynamic_dns_providers_default dynamic_dns_domains as query OUTPUTNEW isDynDNS_default
detect_hosts_connecting_to_dynamic_domain_providers_filter search *
detect_hosts_connecting_to_dynamic_domain_providers_filter is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Annotations

- MITRE ATT&CK
+ Kill Chain Phases
+ NIST
+ CIS
- Threat Actors
ID Technique Tactic
T1189 Drive-by Compromise Initial Access
Delivery
DE.CM
CIS 13

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Setting Value
Disabled true
Cron Schedule 0 * * * *
Earliest Time -70m@m
Latest Time -10m@m
Schedule Window auto
Creates Notable Yes
Rule Title %name%
Rule Description %description%
Notable Event Fields user, dest
Creates Risk Event True
This configuration file applies to all detections of type TTP. These detections will use Risk Based Alerting and generate Notable Events.

Implementation

First, you'll need to ingest data from your DNS operations. This can be done by ingesting logs from your server or data, collected passively by Splunk Stream or a similar solution. Specifically, data that contains the domain that is being queried and the IP of the host originating the request must be populating the Network_Resolution data model. This search also leverages a lookup file, dynamic_dns_providers_default.csv, which contains a non-exhaustive list of Dynamic DNS providers. Please consider updating the local lookup periodically by adding new domains to the list of dynamic_dns_providers_local.csv. This search produces fields (query, answer, isDynDNS) that are not yet supported by ES Incident Review and therefore cannot be viewed when a finding is raised. These fields contribute additional context to the finding. To see the additional metadata, add the following fields, if not already present, to Incident Review. Event Attributes (Configure > Incident Management > Incident Review Settings > Add New Entry):

  • Label: DNS Query, Field: query
  • Label: DNS Answer, Field: answer
  • Label: IsDynamicDNS, Field: isDynDNS

Known False Positives

Some users and applications may leverage Dynamic DNS to reach out to some domains on the Internet since dynamic DNS by itself is not malicious, however this activity must be verified.

Associated Analytic Story

Risk Based Analytics (RBA)

Risk Message:

A dns query $query$ from your infra connecting to suspicious domain

Risk Object Risk Object Type Risk Score Threat Objects
src system 56 No Threat Objects

Detection Testing

Test Type Status Dataset Source Sourcetype
Validation ✅ Passing N/A N/A N/A
Unit ✅ Passing Dataset XmlWinEventLog:Microsoft-Windows-Sysmon/Operational XmlWinEventLog
Integration ✅ Passing Dataset XmlWinEventLog:Microsoft-Windows-Sysmon/Operational XmlWinEventLog

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub | Version: 8