Google DNS - Request to dynamic DNS service

Back


Id	09fc03e0-daec-4b22-8afa-4bba30d7e909
Rulename	Google DNS - Request to dynamic DNS service
Description	Detects requests to ip lookup resources.
Severity	Medium
Tactics	CommandAndControl
Techniques	T1095
Required data connectors	GCPDNSDataConnector
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/GoogleCloudPlatformDNS/Analytic Rules/GCPDNSIpDynDns.yaml
Version	1.0.0
Arm template	09fc03e0-daec-4b22-8afa-4bba30d7e909.json

KQL

let dyndns = dynamic(['noip.com', 'dynu.com', 'dyn.com', 'dynv6.com']);
GCPCloudDNS
| where Query in~ (dyndns)
| extend DNSCustomEntity = Query, IPCustomEntity = SrcIpAddr

YAML

query: |
  let dyndns = dynamic(['noip.com', 'dynu.com', 'dyn.com', 'dynv6.com']);
  GCPCloudDNS
  | where Query in~ (dyndns)
  | extend DNSCustomEntity = Query, IPCustomEntity = SrcIpAddr  
entityMappings:
- entityType: DNS
  fieldMappings:
  - columnName: DNSCustomEntity
    identifier: DomainName
- entityType: IP
  fieldMappings:
  - columnName: IPCustomEntity
    identifier: Address
triggerThreshold: 0
name: Google DNS - Request to dynamic DNS service
severity: Medium
relevantTechniques:
- T1095
queryPeriod: 1h
tactics:
- CommandAndControl
requiredDataConnectors:
- connectorId: GCPDNSDataConnector
  dataTypes:
  - GCPCloudDNS
queryFrequency: 1h
version: 1.0.0
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/GoogleCloudPlatformDNS/Analytic Rules/GCPDNSIpDynDns.yaml
id: 09fc03e0-daec-4b22-8afa-4bba30d7e909
kind: Scheduled
description: |
    'Detects requests to ip lookup resources.'
triggerOperator: gt

ARM