Excessive NXDOMAIN DNS Queries (ASIM DNS Schema)

Severity: medium
Time window: 15m
Group by: SrcIpAddr
Author: Yaron
Source: github.com/Azure/Azure-Sentinel

This creates an incident in the event a client generates excessive amounts of DNS queries for non-existent domains. This analytic rule uses ASIM and supports any built-in or custom source that supports the ASIM DNS schema

MITRE ATT&CK coverage

Tactic	Techniques
Command & Control	`T1008` Fallback Channels `T1568` Dynamic Resolution

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 22: DNSEvent (DNS query)

Rule body

id: c3b11fb2-9201-4844-b7b9-6b7bf6d9b851
name: Excessive NXDOMAIN DNS Queries (ASIM DNS Schema)
description: |
  'This creates an incident in the event a client generates excessive amounts of DNS queries for non-existent domains. 
  This analytic rule uses [ASIM](https://aka.ms/AboutASIM) and supports any built-in or custom source that supports the ASIM DNS schema'
severity: Medium
requiredDataConnectors:
  - connectorId: DNS
    dataTypes:
      - DnsEvents
  - connectorId: AzureFirewall
    dataTypes: 
      - AzureDiagnostics
  - connectorId: Zscaler
    dataTypes:
      - CommonSecurityLog
  - connectorId: InfobloxNIOS
    dataTypes: 
      - Syslog
  - connectorId: GCPDNSDataConnector
    dataTypes: 
      - GCP_DNS_CL
  - connectorId: NXLogDnsLogs
    dataTypes: 
      - NXLog_DNS_Server_CL
  - connectorId: CiscoUmbrellaDataConnector
    dataTypes: 
      - Cisco_Umbrella_dns_CL

  - connectorId: Corelight
    dataTypes: 
      - Corelight_CL
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - CommandAndControl
relevantTechniques:
  - T1568
  - T1008
tags:
  - ParentAlert: https://github.com/Azure/Azure-Sentinel/blob/master/Detections/InfobloxNIOS/ExcessiveNXDOMAINDNSQueries.yaml
    version: 1.0.0
  - Schema: ASIMDns
    SchemaVersion: 0.1.1
query: |
  let threshold = 200;
  _Im_Dns(responsecodename='NXDOMAIN')
  | where isnotempty(DnsResponseCodeName)
  //| where DnsResponseCodeName =~ "NXDOMAIN"
  | summarize count() by SrcIpAddr, bin(TimeGenerated,15m)
  | where count_ > threshold
  | join kind=inner (_Im_Dns(responsecodename='NXDOMAIN')
      ) on SrcIpAddr
entityMappings:
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: SrcIpAddr
version: 1.3.4
kind: Scheduled
metadata:
    source:
        kind: Community
    author:
        name: Yaron
    support:
        tier: Community
    categories:
        domains: [ "Security - Network" ]

Stages and Predicates

Parameters

let threshold = 200;

Stage 1: `source`

_Im_Dns(responsecodename='NXDOMAIN')

Stage 2: `where`

| where isnotempty(DnsResponseCodeName)

Stage 3: `summarize`

| summarize count() by SrcIpAddr, bin(TimeGenerated,15m)

Stage 4: `where`

| where count_ > threshold

Stage 5: `join`

| join kind=inner (_Im_Dns(responsecodename='NXDOMAIN')
    ) on SrcIpAddr

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`DnsResponseCodeName`	is_not_null	(no value, null check)	`field:"DnsResponseCodeName" kind:is_not_null`
`count_`	gt	`200` corpus 5 (kusto 5)	`field:"count_" kind:gt value:"200"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`SrcIpAddr`	`summarize`