Try in Splunk Security Cloud

Description

Attackers often attempt to hide within or otherwise abuse the domain name system (DNS). You can thwart attempts to manipulate this omnipresent protocol by monitoring for these types of abuses.

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel: Endpoint, Network_Resolution
  • Last Updated: 2017-09-18
  • Author: Rico Valdez, Splunk
  • ID: 3c3835c0-255d-4f9e-ab84-e29ec9ec9b56

Narrative

Although DNS is one of the fundamental underlying protocols that make the Internet work, it is often ignored (perhaps because of its complexity and effectiveness). However, attackers have discovered ways to abuse the protocol to meet their objectives. One potential abuse involves manipulating DNS to hijack traffic and redirect it to an IP address under the attacker’s control. This could inadvertently send users intending to visit google.com, for example, to an unrelated malicious website. Another technique involves using the DNS protocol for command-and-control activities with the attacker’s malicious code or to covertly exfiltrate data. The searches within this Analytic Story look for these types of abuses.

Detections

Name Technique Type
Clients Connecting to Multiple DNS Servers Exfiltration Over Unencrypted Non-C2 Protocol TTP
DNS Exfiltration Using Nslookup App Exfiltration Over Alternative Protocol TTP
DNS Exfiltration Using Nslookup App Exfiltration Over Alternative Protocol TTP
DNS Query Length Outliers - MLTK DNS, Application Layer Protocol Anomaly
DNS Query Length With High Standard Deviation Exfiltration Over Unencrypted Non-C2 Protocol, Exfiltration Over Alternative Protocol Anomaly
DNS Query Requests Resolved by Unauthorized DNS Servers DNS TTP
Detect DGA domains using pretrained model in DSDL Domain Generation Algorithms Anomaly
Detect DNS Data Exfiltration using pretrained model in DSDL Exfiltration Over Unencrypted Non-C2 Protocol Anomaly
Detect Long DNS TXT Record Response Exfiltration Over Unencrypted Non-C2 Protocol TTP
Detect hosts connecting to dynamic domain providers Drive-by Compromise TTP
Detect suspicious DNS TXT records using pretrained model in DSDL Domain Generation Algorithms Anomaly
Detection of DNS Tunnels Exfiltration Over Unencrypted Non-C2 Protocol TTP
Excessive DNS Failures DNS, Application Layer Protocol Anomaly
Excessive Usage of NSLOOKUP App Exfiltration Over Alternative Protocol Anomaly

Reference

source | version: 1