Google DNS - Request to dynamic DNS service

Back


Id	09fc03e0-daec-4b22-8afa-4bba30d7e909
Rulename	Google DNS - Request to dynamic DNS service
Description	Detects requests to ip lookup resources.
Severity	Medium
Tactics	CommandAndControl
Techniques	T1095
Required data connectors	GCPDNSDataConnector
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/GoogleCloudPlatformDNS/Analytic Rules/GCPDNSIpDynDns.yaml
Version	1.0.0
Arm template	09fc03e0-daec-4b22-8afa-4bba30d7e909.json

KQL

let dyndns = dynamic(['noip.com', 'dynu.com', 'dyn.com', 'dynv6.com']);
GCPCloudDNS
| where Query in~ (dyndns)
| extend DNSCustomEntity = Query, IPCustomEntity = SrcIpAddr

YAML

entityMappings:
- fieldMappings:
  - columnName: DNSCustomEntity
    identifier: DomainName
  entityType: DNS
- fieldMappings:
  - columnName: IPCustomEntity
    identifier: Address
  entityType: IP
triggerOperator: gt
tactics:
- CommandAndControl
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/GoogleCloudPlatformDNS/Analytic Rules/GCPDNSIpDynDns.yaml
version: 1.0.0
triggerThreshold: 0
relevantTechniques:
- T1095
queryPeriod: 1h
query: |
  let dyndns = dynamic(['noip.com', 'dynu.com', 'dyn.com', 'dynv6.com']);
  GCPCloudDNS
  | where Query in~ (dyndns)
  | extend DNSCustomEntity = Query, IPCustomEntity = SrcIpAddr  
severity: Medium
kind: Scheduled
name: Google DNS - Request to dynamic DNS service
queryFrequency: 1h
id: 09fc03e0-daec-4b22-8afa-4bba30d7e909
description: |
    'Detects requests to ip lookup resources.'
requiredDataConnectors:
- dataTypes:
  - GCPCloudDNS
  connectorId: GCPDNSDataConnector

ARM