Google DNS - UNC2452 Nobelium APT Group activity

Back


Id	22a613ea-c338-4f91-bbd3-3be97b00ebf9
Rulename	Google DNS - UNC2452 (Nobelium) APT Group activity
Description	Detects UNC2452 (Nobelium) APT Group activity.
Severity	High
Tactics	CommandAndControl
Techniques	T1095
Required data connectors	GCPDNSDataConnector
Kind	Scheduled
Query frequency	15m
Query period	15m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/GoogleCloudPlatformDNS/Analytic Rules/GCPDNSUNC2452AptActivity.yaml
Version	1.0.0
Arm template	22a613ea-c338-4f91-bbd3-3be97b00ebf9.json

KQL

GCPCloudDNS
| where Query has_any ('tomasubiera.com', 'theandersonco.com', 'stonecrestnews.com', 'nordicmademedia.com')
| extend DNSCustomEntity = Query, IPCustomEntity = SrcIpAddr

YAML

severity: High
triggerOperator: gt
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/GoogleCloudPlatformDNS/Analytic Rules/GCPDNSUNC2452AptActivity.yaml
id: 22a613ea-c338-4f91-bbd3-3be97b00ebf9
entityMappings:
- fieldMappings:
  - identifier: DomainName
    columnName: DNSCustomEntity
  entityType: DNS
- fieldMappings:
  - identifier: Address
    columnName: IPCustomEntity
  entityType: IP
kind: Scheduled
tactics:
- CommandAndControl
queryFrequency: 15m
requiredDataConnectors:
- connectorId: GCPDNSDataConnector
  dataTypes:
  - GCPCloudDNS
relevantTechniques:
- T1095
version: 1.0.0
description: |
    'Detects UNC2452 (Nobelium) APT Group activity.'
triggerThreshold: 0
query: |
  GCPCloudDNS
  | where Query has_any ('tomasubiera.com', 'theandersonco.com', 'stonecrestnews.com', 'nordicmademedia.com')
  | extend DNSCustomEntity = Query, IPCustomEntity = SrcIpAddr  
queryPeriod: 15m
name: Google DNS - UNC2452 (Nobelium) APT Group activity

ARM