Detection rules › Panther

Panther rules: suspicious

Rule	Severity
Cisco Umbrella Suspicious Domains	`low`

Cisco Umbrella Suspicious Domains

Severity: low
Log types: CiscoUmbrella.DNS
Tags: DNS, Configuration Required
Reference: umbrella.cisco.com
Source: github.com/panther-labs/panther-analysis

Monitor suspicious or known malicious domains

Detection logic

DOMAINS_TO_MONITOR = {"photoscape.ch"}  # Sample malware domain


def rule(event):
    return any(domain in event.get("domain") for domain in DOMAINS_TO_MONITOR)


def title(event):
    return "Suspicious lookup to domain " + event.get("domain", "<UNKNOWN_DOMAIN>")

Rule specification

AnalysisType: rule
Filename: suspicious_domains.py
RuleID: "CiscoUmbrella.DNS.Suspicious"
DisplayName: "Cisco Umbrella Suspicious Domains"
Enabled: false
DedupPeriodMinutes: 480 # 8 hours
LogTypes:
  - CiscoUmbrella.DNS
Tags:
  - DNS
  - Configuration Required
Reference: https://umbrella.cisco.com/blog/abcs-of-dns
Severity: Low
Description: Monitor suspicious or known malicious domains
Runbook: Inspect the domain and check the host for other indicators of compromise
SummaryAttributes:
  - action
  - internalIp
  - externalIp
  - domain
  - responseCode

Stages and Predicates

Fires on CiscoUmbrella.DNS events when the condition below holds.

Condition

domain contains photoscape.ch

Alert deduplication: repeat matches within 8h group into one alert

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`domain`	contains	`photoscape.ch`	`field:"domain" kind:contains value:"photoscape.ch"`

Output fields

Fields the rule emits when it matches, drawn from the rule's alert_context.

Field
`domain`

Response runbook

Inspect the domain and check the host for other indicators of compromise

Worked example

A sample event from the rule's unit tests that triggers a match.

Sample Test Event

{
  "action": "Allow",
  "domain": "cron.photoscape.ch.",
  "externalIp": "136.24.229.58",
  "internalIp": "136.24.229.58",
  "responseCode": "NOERROR",
  "timestamp": "2020-05-21 19:20:25.000"
}