Detect excessive NXDOMAIN DNS queries - Static threshold based ASIM DNS Solution

Back


Id	4ab8b09e-3c23-4974-afbe-7e653779eb2b
Rulename	Detect excessive NXDOMAIN DNS queries - Static threshold based (ASIM DNS Solution)
Description	This rule generates an alert when the configured threshold for DNS queries to non-existent domains is breached. This helps in identifying possible C2 communications. It utilizes ASIM normalization and is applied to any source that supports the ASIM DNS schema.
Severity	Medium
Tactics	CommandAndControl
Techniques	T1568 T1008
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/DNS Essentials/Analytic Rules/ExcessiveNXDOMAINDNSQueriesStaticThresholdBased.yaml
Version	1.0.2
Arm template	4ab8b09e-3c23-4974-afbe-7e653779eb2b.json

KQL

let lookback = 1h;
let threshold = 200;
_Im_Dns(starttime=ago(lookback), responsecodename='NXDOMAIN')
| summarize NXDOMAINCount=count() by SrcIpAddr, bin(TimeGenerated, 15m)
| where NXDOMAINCount > threshold
| join kind=inner (_Im_Dns(starttime=ago(lookback), responsecodename='NXDOMAIN')
  | summarize DNSQueries = makeset(DnsQuery) by SrcIpAddr)
  on SrcIpAddr
| extend NXDOMAINthreshold=threshold
| project-away SrcIpAddr1

YAML

queryFrequency: 1h
triggerThreshold: 0
eventGroupingSettings:
  aggregationKind: AlertPerResult
name: Detect excessive NXDOMAIN DNS queries - Static threshold based (ASIM DNS Solution)
relevantTechniques:
- T1568
- T1008
customDetails:
  DNSQueries: DNSQueries
  NXDOMAINCount: NXDOMAINCount
  NXDOMAINthreshold: NXDOMAINthreshold
id: 4ab8b09e-3c23-4974-afbe-7e653779eb2b
query: |
  let lookback = 1h;
  let threshold = 200;
  _Im_Dns(starttime=ago(lookback), responsecodename='NXDOMAIN')
  | summarize NXDOMAINCount=count() by SrcIpAddr, bin(TimeGenerated, 15m)
  | where NXDOMAINCount > threshold
  | join kind=inner (_Im_Dns(starttime=ago(lookback), responsecodename='NXDOMAIN')
    | summarize DNSQueries = makeset(DnsQuery) by SrcIpAddr)
    on SrcIpAddr
  | extend NXDOMAINthreshold=threshold
  | project-away SrcIpAddr1  
severity: Medium
version: 1.0.2
entityMappings:
- entityType: IP
  fieldMappings:
  - columnName: SrcIpAddr
    identifier: Address
alertDetailsOverride:
  alertDisplayNameFormat: "[Static threshold] Excessive NXDOMAIN DNS Queries has been detected from client IP: '{{SrcIpAddr}}'"
  alertDescriptionFormat: |-
    Client is generating excessive amount of DNS queries for non-existent domains. This can be an indication of possible C2 communications. 

    'NXDOMAIN' error count threshold: '{{NXDOMAINthreshold}}'

    Current 'NXDOMAIN' error count from this client: '{{NXDOMAINCount}}'

    DNS queries requested by the client include:

    '{{DNSQueries}}'    
tags:
- SchemaVersion: 0.1.6
  Schema: ASimDns
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/DNS Essentials/Analytic Rules/ExcessiveNXDOMAINDNSQueriesStaticThresholdBased.yaml
queryPeriod: 1h
tactics:
- CommandAndControl
triggerOperator: gt
requiredDataConnectors: []
status: Available
kind: Scheduled
description: |
    'This rule generates an alert when the configured threshold for DNS queries to non-existent domains is breached. This helps in identifying possible C2 communications. It utilizes [ASIM](https://aka.ms/AboutASIM) normalization and is applied to any source that supports the ASIM DNS schema.'

ARM