Google DNS - Request to dynamic DNS service

Back


Id	09fc03e0-daec-4b22-8afa-4bba30d7e909
Rulename	Google DNS - Request to dynamic DNS service
Description	Detects requests to ip lookup resources.
Severity	Medium
Tactics	CommandAndControl
Techniques	T1095
Required data connectors	GCPDNSDataConnector
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/GoogleCloudPlatformDNS/Analytic Rules/GCPDNSIpDynDns.yaml
Version	1.0.0
Arm template	09fc03e0-daec-4b22-8afa-4bba30d7e909.json

KQL

let dyndns = dynamic(['noip.com', 'dynu.com', 'dyn.com', 'dynv6.com']);
GCPCloudDNS
| where Query in~ (dyndns)
| extend DNSCustomEntity = Query, IPCustomEntity = SrcIpAddr

YAML

kind: Scheduled
query: |
  let dyndns = dynamic(['noip.com', 'dynu.com', 'dyn.com', 'dynv6.com']);
  GCPCloudDNS
  | where Query in~ (dyndns)
  | extend DNSCustomEntity = Query, IPCustomEntity = SrcIpAddr  
triggerThreshold: 0
version: 1.0.0
requiredDataConnectors:
- dataTypes:
  - GCPCloudDNS
  connectorId: GCPDNSDataConnector
relevantTechniques:
- T1095
queryFrequency: 1h
triggerOperator: gt
severity: Medium
entityMappings:
- entityType: DNS
  fieldMappings:
  - identifier: DomainName
    columnName: DNSCustomEntity
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: IPCustomEntity
description: |
    'Detects requests to ip lookup resources.'
tactics:
- CommandAndControl
name: Google DNS - Request to dynamic DNS service
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/GoogleCloudPlatformDNS/Analytic Rules/GCPDNSIpDynDns.yaml
id: 09fc03e0-daec-4b22-8afa-4bba30d7e909
queryPeriod: 1h

ARM