Detection rules › Kusto
Google DNS - UNC2452 (Nobelium) APT Group activity
'Detects UNC2452 (Nobelium) APT Group activity.'
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Command & Control |
Rule body
id: 22a613ea-c338-4f91-bbd3-3be97b00ebf9
name: Google DNS - UNC2452 (Nobelium) APT Group activity
description: |
'Detects UNC2452 (Nobelium) APT Group activity.'
severity: High
requiredDataConnectors:
- connectorId: GCPDNSDataConnector
dataTypes:
- GCPCloudDNS
queryFrequency: 15m
queryPeriod: 15m
triggerOperator: gt
triggerThreshold: 0
tactics:
- CommandAndControl
relevantTechniques:
- T1095
query: |
GCPCloudDNS
| where Query has_any ('tomasubiera.com', 'theandersonco.com', 'stonecrestnews.com', 'nordicmademedia.com')
| extend DNSCustomEntity = Query, IPCustomEntity = SrcIpAddr
entityMappings:
- entityType: DNS
fieldMappings:
- identifier: DomainName
columnName: DNSCustomEntity
- entityType: IP
fieldMappings:
- identifier: Address
columnName: IPCustomEntity
version: 1.0.0
kind: Scheduled
Stages and Predicates
Stage 1: source
GCPCloudDNS
Stage 2: where
| where Query has_any ('tomasubiera.com', 'theandersonco.com', 'stonecrestnews.com', 'nordicmademedia.com')
Stage 3: extend
| extend DNSCustomEntity = Query, IPCustomEntity = SrcIpAddr
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
Query | match |
| field:"Query" kind:match |
Output fields
These fields are emitted when the rule matches.
| Field | Source |
|---|---|
DNSCustomEntity | extend |
IPCustomEntity | extend |