Google DNS - Request to dynamic DNS service

Back


Id	09fc03e0-daec-4b22-8afa-4bba30d7e909
Rulename	Google DNS - Request to dynamic DNS service
Description	Detects requests to ip lookup resources.
Severity	Medium
Tactics	CommandAndControl
Techniques	T1095
Required data connectors	GCPDNSDataConnector
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/GoogleCloudPlatformDNS/Analytic Rules/GCPDNSIpDynDns.yaml
Version	1.0.0
Arm template	09fc03e0-daec-4b22-8afa-4bba30d7e909.json

KQL

let dyndns = dynamic(['noip.com', 'dynu.com', 'dyn.com', 'dynv6.com']);
GCPCloudDNS
| where Query in~ (dyndns)
| extend DNSCustomEntity = Query, IPCustomEntity = SrcIpAddr

YAML

name: Google DNS - Request to dynamic DNS service
query: |
  let dyndns = dynamic(['noip.com', 'dynu.com', 'dyn.com', 'dynv6.com']);
  GCPCloudDNS
  | where Query in~ (dyndns)
  | extend DNSCustomEntity = Query, IPCustomEntity = SrcIpAddr  
entityMappings:
- entityType: DNS
  fieldMappings:
  - columnName: DNSCustomEntity
    identifier: DomainName
- entityType: IP
  fieldMappings:
  - columnName: IPCustomEntity
    identifier: Address
queryPeriod: 1h
tactics:
- CommandAndControl
triggerOperator: gt
kind: Scheduled
triggerThreshold: 0
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/GoogleCloudPlatformDNS/Analytic Rules/GCPDNSIpDynDns.yaml
relevantTechniques:
- T1095
id: 09fc03e0-daec-4b22-8afa-4bba30d7e909
severity: Medium
requiredDataConnectors:
- connectorId: GCPDNSDataConnector
  dataTypes:
  - GCPCloudDNS
version: 1.0.0
description: |
    'Detects requests to ip lookup resources.'
queryFrequency: 1h

ARM