Panther rules: standard

from panther_base_helpers import defang_ioc, is_base64

DECODED = ""


def rule(event):
    query = event.udm("dns_query", default="")
    if not query:
        return False
    args = query.split(".")

    # Check if Base64 encoded arguments are present in the command line
    for arg in args:
        # pylint: disable=global-statement
        global DECODED
        DECODED = is_base64(arg)
        if DECODED:
            return True

    return False


def title(event):
    defang_query = defang_ioc(event.udm("dns_query")) if event.udm("dns_query") else "no query"
    return f'Base64 encoded query detected from [{event.udm("source_ip")}], [{defang_query}]'


def alert_context(event):
    context = {}
    context["source ip"] = event.udm("source_ip")
    context["defanged query"] = (
        defang_ioc(event.udm("dns_query")) if event.udm("dns_query") else "no query"
    )
    context["decoded url part"] = DECODED
    return context

AnalysisType: rule
DisplayName: "DNS Base64 Encoded Query"
Description: Detects DNS queries with Base64 encoded subdomains, which could indicate an attempt to obfuscate data exfil.
RuleID: "Standard.DNSBase64"
Enabled: false
Filename: standard_dns_base64.py
Reference: https://zofixer.com/what-is-base64-disclosure-vulnerability/
Severity: Medium
DedupPeriodMinutes: 60
Threshold: 1
LogTypes:
  - Crowdstrike.FDREvent
  - AWS.VPCDns
  - CiscoUmbrella.DNS