Detection rules › Kusto

Google DNS - Multiple errors to same domain

Severity
medium
Time window
10m
Group by
Query
Source
github.com/Azure/Azure-Sentinel

'Detects multiple errors to same domain.'

MITRE ATT&CK coverage

TacticTechniques
Command & Control

Rule body

id: da04a5d6-e2be-4cba-8cdb-a3f2efa87e9e
name: Google DNS - Multiple errors to same domain
description: |
  'Detects multiple errors to same domain.'
severity: Medium
requiredDataConnectors:
  - connectorId: GCPDNSDataConnector
    dataTypes:
      - GCPCloudDNS
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - CommandAndControl
relevantTechniques:
  - T1095
query: |
  let threshold = 2;
  let err = dynamic(['NXDOMAIN', 'SERVFAIL', 'REFUSED']);
  GCPCloudDNS
  | where EventResultDetails in~ (err)
  | summarize ips = makeset(SrcIpAddr) by Query, bin(TimeGenerated, 10m)
  | where array_length(ips) >= threshold
  | extend DNSCustomEntity = Query, IPCustomEntity = ips
entityMappings:
  - entityType: DNS
    fieldMappings:
      - identifier: DomainName
        columnName: DNSCustomEntity
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: IPCustomEntity
version: 1.0.0
kind: Scheduled

Stages and Predicates

Parameters

let threshold = 2;
let err = dynamic(['NXDOMAIN', 'SERVFAIL', 'REFUSED']);

Stage 1: source

GCPCloudDNS

Stage 2: where

| where EventResultDetails in~ (err)

Stage 3: summarize

| summarize ips = makeset(SrcIpAddr) by Query, bin(TimeGenerated, 10m)

Stage 4: where

| where array_length(ips) >= threshold

Stage 5: extend

| extend DNSCustomEntity = Query, IPCustomEntity = ips

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
EventResultDetailsin
  • NXDOMAIN
  • REFUSED
  • SERVFAIL
field:"EventResultDetails" kind:in

Output fields

These fields are emitted when the rule matches.

FieldSource
Querysummarize
ipssummarize
DNSCustomEntityextend
IPCustomEntityextend