Google DNS - Request to dynamic DNS service

Back


Id	09fc03e0-daec-4b22-8afa-4bba30d7e909
Rulename	Google DNS - Request to dynamic DNS service
Description	Detects requests to ip lookup resources.
Severity	Medium
Tactics	CommandAndControl
Techniques	T1095
Required data connectors	GCPDNSDataConnector
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/GoogleCloudPlatformDNS/Analytic Rules/GCPDNSIpDynDns.yaml
Version	1.0.0
Arm template	09fc03e0-daec-4b22-8afa-4bba30d7e909.json

KQL

let dyndns = dynamic(['noip.com', 'dynu.com', 'dyn.com', 'dynv6.com']);
GCPCloudDNS
| where Query in~ (dyndns)
| extend DNSCustomEntity = Query, IPCustomEntity = SrcIpAddr

YAML

kind: Scheduled
queryFrequency: 1h
queryPeriod: 1h
version: 1.0.0
tactics:
- CommandAndControl
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/GoogleCloudPlatformDNS/Analytic Rules/GCPDNSIpDynDns.yaml
triggerThreshold: 0
description: |
    'Detects requests to ip lookup resources.'
severity: Medium
relevantTechniques:
- T1095
id: 09fc03e0-daec-4b22-8afa-4bba30d7e909
name: Google DNS - Request to dynamic DNS service
requiredDataConnectors:
- dataTypes:
  - GCPCloudDNS
  connectorId: GCPDNSDataConnector
query: |
  let dyndns = dynamic(['noip.com', 'dynu.com', 'dyn.com', 'dynv6.com']);
  GCPCloudDNS
  | where Query in~ (dyndns)
  | extend DNSCustomEntity = Query, IPCustomEntity = SrcIpAddr  
entityMappings:
- fieldMappings:
  - identifier: DomainName
    columnName: DNSCustomEntity
  entityType: DNS
- fieldMappings:
  - identifier: Address
    columnName: IPCustomEntity
  entityType: IP
triggerOperator: gt

ARM