Detection rules › Kusto
Google DNS - CVE-2020-1350 (SIGRED) exploitation pattern
'Detects exploitation pattern of CVE-2020-1350 (SIGRED) vulnerability.'
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Privilege Escalation |
Rule body
id: 1267d53d-f5fd-418b-b8da-34453a5994c2
name: Google DNS - CVE-2020-1350 (SIGRED) exploitation pattern
description: |
'Detects exploitation pattern of CVE-2020-1350 (SIGRED) vulnerability.'
severity: High
requiredDataConnectors:
- connectorId: GCPDNSDataConnector
dataTypes:
- GCPCloudDNS
queryFrequency: 15m
queryPeriod: 15m
triggerOperator: gt
triggerThreshold: 0
tactics:
- PrivilegeEscalation
relevantTechniques:
- T1068
query: |
let threshold = 15;
GCPCloudDNS
| where QueryTypeName in~ ('SIG', 'RRSIG')
| where NetworkProtocol =~ 'TCP'
| summarize count() by SrcIpAddr, bin(TimeGenerated, 1m)
| where count_ < threshold
| extend IPCustomEntity = SrcIpAddr
entityMappings:
- entityType: IP
fieldMappings:
- identifier: Address
columnName: IPCustomEntity
version: 1.0.0
kind: Scheduled
Stages and Predicates
Parameters
let threshold = 15;
Stage 1: source
GCPCloudDNS
Stage 2: where
| where QueryTypeName in~ ('SIG', 'RRSIG')
Stage 3: where
| where NetworkProtocol =~ 'TCP'
Stage 4: summarize
| summarize count() by SrcIpAddr, bin(TimeGenerated, 1m)
Stage 5: where
| where count_ < threshold
Stage 6: extend
| extend IPCustomEntity = SrcIpAddr
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
NetworkProtocol | eq |
| field:"NetworkProtocol" kind:eq value:"TCP" |
QueryTypeName | in |
| field:"QueryTypeName" kind:in |
count_ | lt |
| field:"count_" kind:lt value:"15" |
Output fields
These fields are emitted when the rule matches.
| Field | Source |
|---|---|
SrcIpAddr | summarize |
IPCustomEntity | extend |