Connection to Dynamic DNS Provider by an Unsigned Binary

[rule]
description = """
Identifies DNS queries to known Dynamic DNS Providers by an unsigned program. Dynamic DNS providers are often misused to
host malware Command and Control servers.
"""
id = "75b80e66-90d0-4ab6-9e6b-976f7d690906"
license = "Elastic License v2"
name = "Connection to Dynamic DNS Provider by an Unsigned Binary"
os_list = ["windows"]
reference = [
    "https://www.elastic.co/security-labs/doing-time-with-the-yipphb-dropper",
    "https://www.elastic.co/security-labs/dissecting-remcos-rat-part-four",
]
version = "1.0.38"

query = '''
sequence by process.entity_id with maxspan=1m
 /* execution of an unsigned PEfollowed by dns request to dynamic dns provider */
  [process where event.action == "start" and user.id like ("S-1-5-21*", "S-1-12-*") and
   not process.code_signature.trusted == true and
   process.executable : ("?:\\Users\\*", "?:\\ProgramData\\*", "?:\\Windows\\Temp\\*", "?:\\Windows\\Tasks\\*") and 
   not process.hash.sha256 : 
              ("6cebce1ed45f77ca971281862cc9c9d0085dbc3504a9f1f9a717496cce51c829", 
               "43bd0fa458004d384a31b9147218be267b978506784dd4da141d46195a3ea4d9", 
               "18886da5d34be1f92ddf333c26f8c3a2b0be4da60a7ac4d795da233cbcd9e3bb",
               "94ab0b5595c2ebcf5d571504bf1b771308a5f6b391fe176bb83b98ac2c00c601",
               "b3246fe53f96b4f348be56555e0cfe5ccb990c666954b915163750d31d824155",
               "fc1ff4c34c9a6b504fb8114efef237abb81d68ae689b9f67f0eccf8e6bb0d1cd",
               "7bef5129132799a256fd6c33065e278c1a0e309e9109470a677abc52382bb46e",
               "e4bc373359eab8f6082bbb18cdb7dc08822b3a60ad28fd03ca41d6062bf1c81a",
               "65ae476e29863e8009897686b24618c972461459e09db7a453e1bdf2bd8747a7",
               "18df70114ee93d482b38a420254859326b2d176b87559574202172f6559c3a24",
               "2fcfb8ee597c419c09bd44ac14d7240247f627eb3eca7c7bac2c72142a3a9a53",
               "1618d40484e1ae2c25bbe0dc62e0b09f9213696cd148c622ee22fc3d6e15b6b1",
               "04ae8047e8b63e4ab09446a6a9b5aca49924af06e6ccd7012a3e12c90d5d615a",
               "d9639f20ab1499f38e74b34845db52b9a6afd223ed92936dbe23bffa9c362251",
               "1a840293a0647f5b600fce82e2aca744ee1cc3c362feb4b2703a9088379b420a",
               "495cbe2043fba338beae6da108c132dbfcaad6442c684380ed1397ef353ff58f",
               "88bbc206daf3de3089814da2f3a892ba0332e799be6bdc3349c35bb8b4e125e1",
               "8351ac57bca5f27998283fcc00c670fa9c9f08395cae5231d150630fa24fca1a",
               "7cd7fab80383e59a328e855b63e23c850eee78300b5f726db38ea0745be0bc5f") and
   not (process.code_signature.subject_name == "MarWinCliente" and process.parent.name == "dfsvc.exe" and
        process.code_signature.status == "errorUntrustedRoot") and
   not process.parent.executable : "C:\\Program Files\\Microsoft Visual Studio\\*.exe" and
   not (process.parent.name : "cmd.exe" and process.parent.command_line : "\"C:\\Windows\\system32\\cmd.exe\" ")
   ]
  [dns where
    dns.question.name :
         (
          "*.no-ip.com",
          "*.no-ip.org",
          "*.no-ip.biz",
          "*.no-ip.info",
          "*.noip.com",
          "*.afraid.org",
          "*.changeip.com",
          "*.ddns.net",
          "*.dyndns.org",
          "*.hopto.org",
          "*.zapto.org",
          "*.servehttp.com",
          "*.sytes.net",
          "*.myftp.biz",
          "*.myftp.org",
          "*.ddnsfree.com",
          "*.duckdns.org",
          "*.000webhostapp.com",
          "*.myddns.me",
          "*.dlinkddns.com",
          "*.chickenkiller.com", 
          "*.thddns.net", 
          "*.linkpc.net", 
          "*.gotdns.ch",
          "*.dynv6.net",
          "*.dns.army",
          "*.dns.navy",
          "*.v6.army",
          "*.v6.navy",
          "*.v6.rocks",
          "*.dyndns-office.com",
          "*.myvnc.com",
          "*.is-certified.com"
         ) and

    /* covered by rule Id dfe28e03-9b0b-47f5-9753-65ed2666663f */
    not dns.question.name : "checkip.dyndns.org"]
'''

min_endpoint_version = "7.15.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 1

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1071"
name = "Application Layer Protocol"
reference = "https://attack.mitre.org/techniques/T1071/"
[[threat.technique.subtechnique]]
id = "T1071.004"
name = "DNS"
reference = "https://attack.mitre.org/techniques/T1071/004/"



[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[internal]
min_endpoint_version = "7.15.0"