Tailscale: MagicDNS disabled

Status: available
Severity: medium
Time window: 15m
Source: github.com/Azure/Azure-Sentinel

Identifies when MagicDNS is turned off on the tailnet. Disabling MagicDNS changes DNS behaviour for every device and is occasionally a precursor to wider DNS hijacking - verify the change was intentional.

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	`T1556` Modify Authentication Process
Defense Impairment	`T1556` Modify Authentication Process
Credential Access	`T1556` Modify Authentication Process

Rule body

id: f8a9b0c1-4567-8901-23ab-cdef12345020
name: "Tailscale: MagicDNS disabled"
description: |
  Identifies when MagicDNS is turned off on the tailnet. Disabling MagicDNS changes DNS behaviour for every device and is occasionally a precursor to wider DNS hijacking - verify the change was intentional.
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: TailscaleCCF
    dataTypes:
      - Tailscale_Audit_CL
queryFrequency: 15m
queryPeriod: 15m
triggerOperator: gt
triggerThreshold: 0
tactics:
  - DefenseEvasion
relevantTechniques:
  - T1556
query: |
  Tailscale_Audit_CL
  | where Action == "UPDATE"
  | where tostring(Target.type) == "TAILNET"
  | where tostring(Target.property) == "MAGICDNS_PREFERENCES"
  | extend ActorLogin = tostring(Actor.loginName)
  | extend OldMagicDns = tobool(Old.magicDNS)
  | extend NewMagicDns = tobool(New.magicDNS)
  | where OldMagicDns == true and NewMagicDns == false
  | project TimeGenerated, ActorLogin, OldMagicDns, NewMagicDns, Origin
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: ActorLogin
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: true
    reopenClosedIncident: false
    lookbackDuration: P1D
    matchingMethod: AllEntities
kind: Scheduled
version: 1.0.0

Stages and Predicates

Stage 1: `source`

Tailscale_Audit_CL

Stage 2: `where`

| where Action == "UPDATE"

Stage 3: `where`

| where tostring(Target.type) == "TAILNET"

Stage 4: `where`

| where tostring(Target.property) == "MAGICDNS_PREFERENCES"

Stage 5: `extend` (3 consecutive steps)

| extend ActorLogin = tostring(Actor.loginName)
| extend OldMagicDns = tobool(Old.magicDNS)
| extend NewMagicDns = tobool(New.magicDNS)

Stage 6: `where`

| where OldMagicDns == true and NewMagicDns == false

Stage 7: `project`

| project TimeGenerated, ActorLogin, OldMagicDns, NewMagicDns, Origin

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Action`	eq	`UPDATE`	`field:"Action" kind:eq value:"UPDATE"`
`NewMagicDns`	eq	`false`	`field:"NewMagicDns" kind:eq value:"false"`
`OldMagicDns`	eq	`true`	`field:"OldMagicDns" kind:eq value:"true"`
`property`	eq	`MAGICDNS_PREFERENCES` transforms: `tostring`	`field:"property" kind:eq value:"MAGICDNS_PREFERENCES"`
`type`	eq	`TAILNET` transforms: `tostring`	`field:"type" kind:eq value:"TAILNET"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`ActorLogin`	`project`
`NewMagicDns`	`project`
`OldMagicDns`	`project`
`Origin`	`project`
`TimeGenerated`	`project`

Tailscale: MagicDNS disabled

MITRE ATT&CK coverage

Rule body

Stages and Predicates

Stage 1: source

Stage 2: where

Stage 3: where

Stage 4: where

Stage 5: extend (3 consecutive steps)

Stage 6: where

Stage 7: project