Detection rules › Splunk
Detect Windows DNS SIGRed via Splunk Stream
The following analytic detects attempts to exploit the SIGRed vulnerability (CVE-2020-1350) in Windows DNS servers. It leverages Splunk Stream DNS and TCP data to identify DNS SIG and KEY records, as well as TCP payloads exceeding 65KB. This activity is significant because SIGRed is a critical wormable vulnerability that allows remote code execution. If confirmed malicious, an attacker could gain unauthorized access, execute arbitrary code, and potentially disrupt services, leading to severe data breaches and infrastructure compromise. Immediate investigation and remediation are crucial to mitigate these risks.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Execution | T1203 Exploitation for Client Execution |
Rule body splunk
name: Detect Windows DNS SIGRed via Splunk Stream
id: babd8d10-d073-11ea-87d0-0242ac130003
version: 9
creation_date: '2020-08-04'
modification_date: '2026-05-13'
author: Shannon Davis, Splunk
status: experimental
type: TTP
description: The following analytic detects attempts to exploit the SIGRed vulnerability (CVE-2020-1350) in Windows DNS servers. It leverages Splunk Stream DNS and TCP data to identify DNS SIG and KEY records, as well as TCP payloads exceeding 65KB. This activity is significant because SIGRed is a critical wormable vulnerability that allows remote code execution. If confirmed malicious, an attacker could gain unauthorized access, execute arbitrary code, and potentially disrupt services, leading to severe data breaches and infrastructure compromise. Immediate investigation and remediation are crucial to mitigate these risks.
data_source: []
search: |
`stream_dns`
| spath "query_type{}"
| search "query_type{}" IN (SIG,KEY)
| spath protocol_stack
| search protocol_stack="ip:tcp:dns"
| append [search `stream_tcp` bytes_out>65000]
| stats count by flow_id
| where count>1
| fields - count
| `detect_windows_dns_sigred_via_splunk_stream_filter`
how_to_implement: You must be ingesting Splunk Stream DNS and Splunk Stream TCP. We are detecting SIG and KEY records via stream:dns and TCP payload over 65KB in size via stream:tcp. Replace the macro definitions ('stream:dns' and 'stream:tcp') with configurations for your Splunk environment.
known_false_positives: No false positives have been identified at this time.
references: []
finding:
title: Potential SIGRed activity detected [ $flow_id$ ]
entity:
field: flow_id
type: other
score: 50
analytic_story:
- Windows DNS SIGRed CVE-2020-1350
asset_type: Endpoint
cve:
- CVE-2020-1350
mitre_attack_id:
- T1203
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
category: network
security_domain: network
Stages and Predicates
Stage 1: search
`stream_dns`
Stage 2: spath
| spath "query_type{}"
Stage 3: search
| search "query_type{}" IN (SIG,KEY)
Stage 4: spath
| spath protocol_stack
Stage 5: search
| search protocol_stack="ip:tcp:dns"
Stage 6: append
| append [search `stream_tcp` bytes_out>65000]
Stage 7: stats
| stats count by flow_id
Stage 8: where
| where count>1
Stage 9: fields
| fields - count
Stage 10: search
| `detect_windows_dns_sigred_via_splunk_stream_filter`
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
"query_type{}" | in |
|
bytes_out | gt |
|
count | gt |
|
protocol_stack | eq |
|
sourcetype | eq |
|