Google DNS - IP check activity
Id | 35221a58-cacb-4174-9bb4-ee777784fbce |
Rulename | Google DNS - IP check activity |
Description | Detects requests to ip lookup resources. |
Severity | Medium |
Tactics | CommandAndControl |
Techniques | T1095 |
Required data connectors | GCPDNSDataConnector |
Kind | Scheduled |
Query frequency | 1h |
Query period | 1h |
Trigger threshold | 0 |
Trigger operator | gt |
Source Uri | https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/GoogleCloudPlatformDNS/Analytic Rules/GCPDNSIpCheck.yaml |
Version | 1.0.0 |
Arm template | 35221a58-cacb-4174-9bb4-ee777784fbce.json |
let ip_check = dynamic(['whatismyipaddress.com', 'ip2location.com', 'ipaddress.my', 'whatismyip.com', 'ipinfo.info', 'checkmyip.com', 'myip.com', 'checkmyip.org', 'canireachthe.net', 'ipv4.icanhazip.com', 'ip.anysrc.net', 'edns.ip-api.com', 'wtfismyip.com', 'checkip.dyndns.org', 'api.2ip.ua', 'icanhazip.com', 'api.ipify.org', 'ip-api.com', 'checkip.amazonaws.com', 'ipecho.net', 'ipinfo.io', 'ipv4bot.whatismyipaddress.com', 'freegeoip.app', 'checkip.azurewebsites.net']);
GCPCloudDNS
| where Query in~ (ip_check)
| extend DNSCustomEntity = Query, IPCustomEntity = SrcIpAddr
queryFrequency: 1h
triggerOperator: gt
tactics:
- CommandAndControl
description: |
'Detects requests to ip lookup resources.'
relevantTechniques:
- T1095
query: |
let ip_check = dynamic(['whatismyipaddress.com', 'ip2location.com', 'ipaddress.my', 'whatismyip.com', 'ipinfo.info', 'checkmyip.com', 'myip.com', 'checkmyip.org', 'canireachthe.net', 'ipv4.icanhazip.com', 'ip.anysrc.net', 'edns.ip-api.com', 'wtfismyip.com', 'checkip.dyndns.org', 'api.2ip.ua', 'icanhazip.com', 'api.ipify.org', 'ip-api.com', 'checkip.amazonaws.com', 'ipecho.net', 'ipinfo.io', 'ipv4bot.whatismyipaddress.com', 'freegeoip.app', 'checkip.azurewebsites.net']);
GCPCloudDNS
| where Query in~ (ip_check)
| extend DNSCustomEntity = Query, IPCustomEntity = SrcIpAddr
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/GoogleCloudPlatformDNS/Analytic Rules/GCPDNSIpCheck.yaml
severity: Medium
triggerThreshold: 0
version: 1.0.0
entityMappings:
- entityType: DNS
fieldMappings:
- identifier: DomainName
columnName: DNSCustomEntity
- entityType: IP
fieldMappings:
- identifier: Address
columnName: IPCustomEntity
name: Google DNS - IP check activity
id: 35221a58-cacb-4174-9bb4-ee777784fbce
requiredDataConnectors:
- connectorId: GCPDNSDataConnector
dataTypes:
- GCPCloudDNS
kind: Scheduled
queryPeriod: 1h
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"workspace": {
"type": "String"
}
},
"resources": [
{
"id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/35221a58-cacb-4174-9bb4-ee777784fbce')]",
"name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/35221a58-cacb-4174-9bb4-ee777784fbce')]",
"type": "Microsoft.OperationalInsights/workspaces/providers/alertRules",
"kind": "Scheduled",
"apiVersion": "2022-11-01",
"properties": {
"displayName": "Google DNS - IP check activity",
"description": "'Detects requests to ip lookup resources.'\n",
"severity": "Medium",
"enabled": true,
"query": "let ip_check = dynamic(['whatismyipaddress.com', 'ip2location.com', 'ipaddress.my', 'whatismyip.com', 'ipinfo.info', 'checkmyip.com', 'myip.com', 'checkmyip.org', 'canireachthe.net', 'ipv4.icanhazip.com', 'ip.anysrc.net', 'edns.ip-api.com', 'wtfismyip.com', 'checkip.dyndns.org', 'api.2ip.ua', 'icanhazip.com', 'api.ipify.org', 'ip-api.com', 'checkip.amazonaws.com', 'ipecho.net', 'ipinfo.io', 'ipv4bot.whatismyipaddress.com', 'freegeoip.app', 'checkip.azurewebsites.net']);\nGCPCloudDNS\n| where Query in~ (ip_check)\n| extend DNSCustomEntity = Query, IPCustomEntity = SrcIpAddr\n",
"queryFrequency": "PT1H",
"queryPeriod": "PT1H",
"triggerOperator": "GreaterThan",
"triggerThreshold": 0,
"suppressionDuration": "PT1H",
"suppressionEnabled": false,
"tactics": [
"CommandAndControl"
],
"techniques": [
"T1095"
],
"alertRuleTemplateName": "35221a58-cacb-4174-9bb4-ee777784fbce",
"customDetails": null,
"entityMappings": [
{
"entityType": "DNS",
"fieldMappings": [
{
"identifier": "DomainName",
"columnName": "DNSCustomEntity"
}
]
},
{
"entityType": "IP",
"fieldMappings": [
{
"identifier": "Address",
"columnName": "IPCustomEntity"
}
]
}
],
"templateVersion": "1.0.0",
"OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/GoogleCloudPlatformDNS/Analytic Rules/GCPDNSIpCheck.yaml"
}
}
]
}