detection.wiki

Detection rules › Sigma

DNS Server Discovery Via LDAP Query

Status
test
Severity
low
Log source
product windows, category dns_query
Author
frack113
Source
github.com/SigmaHQ/sigma

Detects DNS server discovery via LDAP query requests from uncommon applications

MITRE ATT&CK coverage

TacticTechniques
DiscoveryT1482 Domain Trust Discovery

Event coverage

ProviderEventTitle
SysmonEvent ID 22DNSEvent (DNS query)

Rule body yaml

title: DNS Server Discovery Via LDAP Query
id: a21bcd7e-38ec-49ad-b69a-9ea17e69509e
status: test
description: Detects DNS server discovery via LDAP query requests from uncommon applications
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/980f3f83fd81f37c1ca9c02dccfd1c3d9f9d0841/atomics/T1016/T1016.md#atomic-test-9---dns-server-discovery-using-nslookup
    - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/7fcdce70-5205-44d6-9c3a-260e616a2f04
author: frack113
date: 2022-08-20
modified: 2023-09-18
tags:
    - attack.discovery
    - attack.t1482
logsource:
    product: windows
    category: dns_query
detection:
    selection:
        QueryName|startswith: '_ldap.'
    filter_main_generic:
        Image|contains:
            - ':\Program Files\'
            - ':\Program Files (x86)\'
            - ':\Windows\'
    filter_main_defender:
        Image|contains: ':\ProgramData\Microsoft\Windows Defender\Platform\'
        Image|endswith: '\MsMpEng.exe'
    filter_main_unknown:
        Image: '<unknown process>'
    filter_optional_azure:
        Image|startswith: 'C:\WindowsAzure\GuestAgent'
    filter_main_null:
        Image: null
    filter_optional_browsers:
        # Note: This list is for browsers installed in the user context. To avoid basic evasions based on image name. Best to baseline this list with the browsers you use internally and add their full paths.
        Image|endswith:
            - '\chrome.exe'
            - '\firefox.exe'
            - '\opera.exe'
    condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
    - Likely
# Note: Incrase the level once a baseline is established
level: low

Stages and Predicates

Stage 0: condition

selection and not 1 of filter_main_* and not 1 of filter_optional_*

Stage 1: selection

selection:
    QueryName|startswith: '_ldap.'

Stage 2: not filter_main_*

filter_main_generic:
    Image|contains:
        - ':\Program Files\'
        - ':\Program Files (x86)\'
        - ':\Windows\'
filter_main_defender:
    Image|contains: ':\ProgramData\Microsoft\Windows Defender\Platform\'
    Image|endswith: '\MsMpEng.exe'
filter_main_unknown:
    Image: '<unknown process>'
filter_main_null:
    Image: null

Stage 3: not filter_optional_*

filter_optional_azure:
    Image|startswith: 'C:\WindowsAzure\GuestAgent'
filter_optional_browsers:
    Image|endswith:
        - '\chrome.exe'
        - '\firefox.exe'
        - '\opera.exe'

Exclusions

Top-level NOT(...) conjuncts: predicates this rule actively suppresses.

FieldKindExcluded values
Imageends_with\MsMpEng.exe
Imagematch:\ProgramData\Microsoft\Windows Defender\Platform\
Imageeq<unknown process>
Imageis_null(no value, null check)
Imagematch:\Program Files (x86)\
Imagematch:\Program Files\
Imagematch:\Windows\
Imageends_with\chrome.exe
Imageends_with\firefox.exe
Imageends_with\opera.exe
Imagestarts_withC:\WindowsAzure\GuestAgent

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
QueryNamestarts_with
  • _ldap.