DNS Query to Suspicious Top Level Domain

[rule]
description = """
Identifies DNS queries to commonly abused Top Level Domains by a process running from a mounted virtual disk (.iso,
.vhd) or that was recently dropped and not signed by a trusted code signature or commonly abused Microsoft signed
binaries.
"""
id = "d37ffe39-8e58-460f-938d-3bafbae60711"
license = "Elastic License v2"
name = "DNS Query to Suspicious Top Level Domain"
os_list = ["windows"]
version = "1.0.43"

query = '''
sequence by process.entity_id with maxspan=1m
 [process where event.action == "start" and
  (
   (process.Ext.device.product_id : ("Virtual DVD-ROM", "Virtual Disk") and
    not process.executable : "C:\\*") or

   ((process.Ext.relative_file_creation_time <= 300 or process.Ext.relative_file_name_modify_time <= 300) and
     not process.code_signature.status : ("trusted", "errorExpired", "errorCode_endpoint*") and
     not process.executable : ("?:\\Program Files\\*.exe", "?:\\Program Files (x86)\\*.exe")) or

   process.executable :
	        ("?:\\Users\\*\\AppData\\Local\\Temp\\Temp?_*",
	         "?:\\Users\\*\\AppData\\Local\\Temp\\7z*",
	         "?:\\Users\\*\\AppData\\Local\\Temp\\Rar$*") or

   process.name : ("powershell.exe", "wscript.exe", "cscript.exe", "rundll32.exe", "msiexec.exe", "mshta.exe") or

   (process.name : "python*" or process.code_signature.subject_name : "Python Software Foundation") or

   (process.Ext.relative_file_creation_time <= 500 and process.pe.original_file_name : ("node.exe", "AutoIt*.exe"))
   ) and

   not (process.name : "rundll32.exe" and
        process.args : ("?:\\windows\\system32\\davclnt.dll,DavSetCookie",
                        "?:\\Windows\\SysWOW64\\davclnt.dll,DavSetCookie",
                        "cryptext.dll,CryptExtOpenCER",
                        "cryptext.dll,CryptExtAddCER",
                        "?:\\Windows\\system32\\cryptext.dll,CryptExt*",
                        "shell32.dll,Control_RunDLL",
                        "?:\\Program Files\\*",
                        "?:\\Program Files (x86)\\*",
                        "?:\\PROGRA~?\\MICROS~?\\*",
                        "?:\\WINDOWS\\Sys*\\shell32.dll,#44",
                        "?:\\PROGRA~?\\MICROS~2\\Office*\\MLCFG32.CPL,@0")) and
   not process.parent.executable :
                    ("C:\\Program Files\\Windows Defender Advanced Threat Protection\\SenseIR.exe",
                     "C:\\Program Files\\Microsoft Visual Studio\\*.exe",
                     "C:\\Program Files\\Nitro\\PDF Pro\\??\\NitroPDF.exe") and
   not process.hash.sha256 :
                   ("19a9ed41a69c74f130f53572aa1b07b1fa35d93a408dcf9d3f16f0fd72dd1e69",
                    "005f63a30438bf91d23790bfd6ab43d298e73c48024d7f48aec322b798035130",
                    "39508f47cd1220a313928d983139a3a27afdb676082c58ac2db71dfcceab4b00",
                    "b0136acc093fe905257da3fc0591de3f6209b24f6b943ff73b9939ec5f80099d",
                    "454dc1f557995b4c1570d74110673b72172640eb3a5a3f5da304faa4a081650f",
                    "bd8c182176f4e177c62240e8f5941446df01c21c57ad6f304e4e0af21cba52de",
                    "6422aea329efdcc7385541801ee271f9104382cc5e9b8eafb0deae25886bd3ff",
                    "93b47471ca51a22f08d489d6a17764dbfb492989f7f6add5f09243719c6bb73b",
                    "d0557e9aca48065910225cd5776de67c0d887ae1d7346204a01bc85d870d7c1d",
                    "454dc1f557995b4c1570d74110673b72172640eb3a5a3f5da304faa4a081650f",
                    "bd8c182176f4e177c62240e8f5941446df01c21c57ad6f304e4e0af21cba52de",
                    "e1684e5c9589d2947df49a0c8382a06040a5443d9ba32d06374049fcb88643b4",
                    "7af4edd697f6881671d661d343dfaef243c6b630bd7d0816ddec9e049931e841",
                    "3281760911711b9ccb262b217e8cbb625c8c5f2d585c3a7a04a2ba2a4f4e918b",
                    "2167901996b1deff1f165c2d1575820a1c20840b19f8d98b4fd84b7a996cef42",
                    "b8aabf174578bfc91c9ab46fab0c75c12efd66da00402a41259acef53e0ebefd",
                    "bcfa1343b6bd0176785ecacfeda0c2eefd2c391d0f7c21a9c465fdb9f5143f63",
                    "f5e8d65a3ad7ded72c27addfd2d2ef98f8e2c9255adec4a216353eee0e8ec482",
                    "9421439e100d116173d28edbf180a04d3c677bca4e88c3ef46911fbd12a63426",
                    "8ca10f59fe3c6c1b44331f7a7378f717481d58fbad53d7ea25894469ef563e0c",
                    "a68a4b4101bb097f886548b13991db8d71f9cfb55801c403ad7b57844bbc288f",
                    "b25fc6258895702c5fd0297cba15b1bd733b5443e7f6f43137877198f27b1322",
                    "4b0f6852329ae6118124956e95c091fbf5c7592b8dd717c9163a07b72074c65d",
                    "143d4b9e429bb10860298c16feab3bf0f132e26547ee28eecd1f7de9f5cf926c",
                    "3b49c90ff2571e045cb5fd985b7397b37d7bb83e58729a0b4e44b0e5543135df",
                    "ca2a11a3fbebc36ff3a3ec7428263f07a3aeb09db2215f882a66a7c1c61d9e6f",
                    "6b1880dce6f28d4a79f4fa3be148ee55793e679485c3db156d26abd6d277b44a",
                    "d3a1446ff14a77a4beb61f4db93afec24a6daa8fad566ddbddbc74943169b5b1",
                    "f79605915297ceac917d58e629bbfb7c50cac8d7c563bf207c5c84abd2956008",
                    "f0822cd0265b889d65c3bd6af51b5ebd9f13b7e067b97b62d923d3693f9b22ca",
                    "9e039448344e4f70122a9cb2416cf282d26033ec8a81b3084c8e7076e3242d8b") and
   not process.executable : ("?:\\Program Files\\Makeblock\\xTool Creative Space\\xTool Creative Space.exe",
                             "?:\\Program Files (x86)\\Popcorn Time\\PopcornTimeDesktop.exe",
                             "?:\\Program Files\\ArcGIS\\DataStore\\framework\\runtime\\pgsql\\bin\\postgres.exe",
                             "?:\\Program Files\\OpenVPN Connect\\OpenVPNConnect.exe",
                             "?:\\Program Files\\Softdeluxe\\Free Download Manager\\fdm.exe",
                             "C:\\Program Files\\ArcGIS\\Pro\\bin\\Python\\envs\\arcgispro-py?\\python.exe",
                             "C:\\Program Files (x86)\\Wondershare\\MobileTrans\\MobileTrans.exe",
                             "C:\\Program Files (x86)\\Wondershare\\drfone\\DrFoneToolKit.exe",
                             "C:\\Program Files\\RFMS\\Measure\\msr6.exe") and
   not (process.name : "powershell.exe" and process.parent.executable : "?:\\Program Files\\Sophos\\Endpoint Defense\\SEDService.exe") and
   not (process.name : "powershell.exe" and process.args : "C:\\ProgramData\\NinjaRMMAgent\\uscripting\\customscript_gen_*.ps1")]
 [dns where
  dns.question.name : ("*.top", "*.buzz", "*.xyz", "*.rest", "*.ml", "*.cf", "*.gq", "*.ga", "*.onion",
                       "*.monster", "*.cyou", "*.quest", "*.cc", "*.bar", "*.cfd", "*.click", "*.cam",
                       "*.surf", "*.tk", "*.shop", "*.club", "*.icu", "*.pw", "*.ws",
                      "*.online", "*.fun", "*.life", "*.boats", "*.store",
                       "*.hair", "*.skin", "*.motorcycles", "*.christmas", "*.lol", "*.makeup",
                       "*.mom", "*.rest", "*.monster", "*.bond", "*.beauty", "*.biz", "*.live", "*.zone", ".cloud") and
  not (process.name : "powershell.exe" and dns.question.name : "*.engage.xyz") and
  not dns.question.name like ("wfdownloader.xyz", "licenseauth.online", "nexaquest.store", "api.ratna.pw", "bo3.ezz.lol", "acesso.ws", "*.thomsonreuters.biz", "bestpractice.online", "*.ad-alliance.biz",
                              "www.frontierpestcontrol.biz", "krauseconstruction.click", "whois.nic.biz", "*.manatron.biz",
                              "ppmc02p.salzburg.ssk.cc", "*.envlab.cc",
                              "mastodon.online", "api.hyperliquid.xyz", "publica.cnpj.ws",
                              "aristotle.harmonic.fun", "*.lighter.xyz")]
'''

min_endpoint_version = "8.4.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
tree = true

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1204"
name = "User Execution"
reference = "https://attack.mitre.org/techniques/T1204/"
[[threat.technique.subtechnique]]
id = "T1204.002"
name = "Malicious File"
reference = "https://attack.mitre.org/techniques/T1204/002/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1071"
name = "Application Layer Protocol"
reference = "https://attack.mitre.org/techniques/T1071/"
[[threat.technique.subtechnique]]
id = "T1071.004"
name = "DNS"
reference = "https://attack.mitre.org/techniques/T1071/004/"



[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[internal]
min_endpoint_version = "8.4.0"