VPC Flow Logs Unapproved Outbound DNS Traffic

AnalysisType: rule
Filename: aws_vpc_unapproved_outbound_dns.py
RuleID: "AWS.VPC.UnapprovedOutboundDNS"
DisplayName: "VPC Flow Logs Unapproved Outbound DNS Traffic"
Enabled: false
LogTypes:
  - AWS.VPCFlow
  - OCSF.NetworkActivity
Tags:
  - AWS
  - DataModel
  - Configuration Required
  - Security Control
  - Command and Control:Application Layer Protocol
Reports:
  MITRE ATT&CK:
    - TA0011:T1071
Reference: https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html
Severity: Medium
Description: >
  Alerts if outbound DNS traffic is detected to a non-approved DNS server. DNS is often used as a means to exfiltrate data or perform command and control for compromised hosts. All DNS traffic should be routed through internal DNS servers or trusted 3rd parties.
Runbook: >
  Investigate the host sending unapproved DNS activity for signs of compromise or other malicious activity. Update network configurations appropriately to ensure all DNS traffic is routed to approved DNS servers.
SummaryAttributes:
  - srcaddr
  - dstaddr
  - dstport
Tests:
  - Name: Approved Outbound DNS Traffic
    ExpectedResult: false
    Log:
      {
        "dstPort": 53,
        "dstAddr": "1.1.1.1",
        "srcAddr": "10.0.0.1",
        "p_log_type": "AWS.VPCFlow",
      }
  - Name: Unapproved Outbound DNS Traffic
    ExpectedResult: true
    Log:
      {
        "dstPort": 53,
        "dstAddr": "100.100.100.100",
        "srcAddr": "10.0.0.1",
        "p_log_type": "AWS.VPCFlow",
      }
  - Name: Outbound Non-DNS Traffic
    ExpectedResult: false
    Log:
      {
        "dstPort": 80,
        "dstAddr": "100.100.100.100",
        "srcAddr": "10.0.0.1",
        "p_log_type": "AWS.VPCFlow",
      }
  - Name: Approved Outbound DNS Traffic - OCSF
    ExpectedResult: false
    Log:
      {
        "dst_endpoint": { "ip": "1.1.1.1", "port": 53 },
        "src_endpoint": { "ip": "10.0.0.1" },
        "p_log_type": "OCSF.NetworkActivity",
      }
  - Name: Unapproved Outbound DNS Traffic - OCSF
    ExpectedResult: true
    Log:
      {
        "dst_endpoint": { "ip": "100.100.100.100", "port": 53 },
        "src_endpoint": { "ip": "10.0.0.1" },
        "p_log_type": "OCSF.NetworkActivity",
      }