Lumen TI domain in DnsEvents

Severity: medium
Time window: 14d
Group by: DNS_domainEntity, Id, TI_domainEntity
Source: github.com/Azure/Azure-Sentinel

This query searches for matches between Lumen threat intelligence domain indicators and DnsEvents.

MITRE ATT&CK coverage

Tactic	Techniques
Command & Control	`T1071` Application Layer Protocol

Rule body

id: 29bf5bcd-6795-4c79-a91f-aaef5a618bab
name: Lumen TI domain in DnsEvents
displayName: Lumen TI domain in DnsEvents
description: |
  This query searches for matches between Lumen threat intelligence domain indicators and DnsEvents.
severity: Medium
requiredDataConnectors:
  - connectorId: LumenThreatFeedConnector
    dataTypes:
      - ThreatIntelligenceIndicator
  - connectorId: ThreatIntelligenceUploadIndicatorsAPI
    dataTypes:
      - ThreatIntelligenceIndicator
  - connectorId: DNS
    dataTypes:
      - DnsEvents
queryFrequency: 4h
queryPeriod: 14d
triggerOperator: gt
triggerThreshold: 0
suppressionDuration: 5h
suppressionEnabled: true
tactics:
  - CommandAndControl
relevantTechniques:
  - T1071
query: |
  let dt_lookBack = 1d; // Data lookback for DnsEvents
  let ioc_lookBack = 14d; // TI lookback
  // Latest, active, non-expired Lumen domain indicators
  let Domain_Indicators = ThreatIntelIndicators
    | where TimeGenerated >= ago(ioc_lookBack)
    | where IsActive == true and ValidUntil > now()
    | summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by Id
    | where SourceSystem == 'Lumen'
    | where ObservableKey == 'domain-name:value' or ObservableValue contains '.'
    | extend TI_domainEntity = tostring(ObservableValue);
  Domain_Indicators
  | join kind=innerunique (
      DnsEvents
      | where TimeGenerated >= ago(dt_lookBack)
      | extend DNS_domainEntity = Name
      | extend DnsEvents_TimeGenerated = TimeGenerated
    ) on $left.TI_domainEntity == $right.DNS_domainEntity
  | where DnsEvents_TimeGenerated < ValidUntil
  | summarize arg_max(DnsEvents_TimeGenerated, *), StartTime = min(DnsEvents_TimeGenerated), EndTime = max(DnsEvents_TimeGenerated) by Id, DNS_domainEntity
  | project timestamp = EndTime, StartTime, EndTime, Name, QueryType, Computer, Id, Tags, ValidUntil, Confidence, TI_domainEntity, DNS_domainEntity, Type
entityMappings:
  - entityType: DNS
    fieldMappings:
      - identifier: DomainName
        columnName: DNS_domainEntity
version: 1.0.0
kind: Scheduled

Stages and Predicates

Parameters

let dt_lookBack = 1d;
let ioc_lookBack = 14d;

let Domain_Indicators is inlined into the numbered stages below.

Stages 1 to 7 define let Domain_Indicators (the rule's main pipeline source); stages 8 to 11 run on it.

Stage 1: `source`

ThreatIntelIndicators

Stage 2: `where`

| where TimeGenerated >= ago(ioc_lookBack)

Stage 3: `where`

| where IsActive == true and ValidUntil > now()

Stage 4: `summarize`

| summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by Id

Stage 5: `where`

| where SourceSystem == 'Lumen'

Stage 6: `where`

| where ObservableKey == 'domain-name:value' or ObservableValue contains '.'

Stage 7: `extend`

| extend TI_domainEntity = tostring(ObservableValue)

Stage 8: `join`

Domain_Indicators
| join kind=innerunique (
    DnsEvents
    | where TimeGenerated >= ago(dt_lookBack)
    | extend DNS_domainEntity = Name
    | extend DnsEvents_TimeGenerated = TimeGenerated
  ) on $left.TI_domainEntity == $right.DNS_domainEntity

Stage 9: `where`

| where DnsEvents_TimeGenerated < ValidUntil

Stage 10: `summarize`

| summarize arg_max(DnsEvents_TimeGenerated, *), StartTime = min(DnsEvents_TimeGenerated), EndTime = max(DnsEvents_TimeGenerated) by Id, DNS_domainEntity

Stage 11: `project`

| project timestamp = EndTime, StartTime, EndTime, Name, QueryType, Computer, Id, Tags, ValidUntil, Confidence, TI_domainEntity, DNS_domainEntity, Type

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`DnsEvents_TimeGenerated`	cross_field_compare	`ValidUntil` transforms: `op:lt`	`field:"DnsEvents_TimeGenerated" kind:cross_field_compare value:"ValidUntil"`
`IsActive`	eq	`true`	`field:"IsActive" kind:eq value:"true"`
`ObservableKey`	eq	`domain-name:value`	`field:"ObservableKey" kind:eq value:"domain-name:value"`
`ObservableValue`	contains	`.`	`field:"ObservableValue" kind:contains value:"."`
`SourceSystem`	eq	`Lumen`	`field:"SourceSystem" kind:eq value:"Lumen"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`Computer`	`project`
`Confidence`	`project`
`DNS_domainEntity`	`project`
`EndTime`	`project`
`Id`	`project`
`Name`	`project`
`QueryType`	`project`
`StartTime`	`project`
`TI_domainEntity`	`project`
`Tags`	`project`
`Type`	`project`
`ValidUntil`	`project`
`timestamp`	`project`

Lumen TI domain in DnsEvents

MITRE ATT&CK coverage

Rule body

Stages and Predicates

Parameters

Stage 1: source

Stage 2: where

Stage 3: where

Stage 4: summarize

Stage 5: where

Stage 6: where

Stage 7: extend

Stage 8: join

Stage 9: where

Stage 10: summarize

Stage 11: project