Detect excessive NXDOMAIN DNS queries - Static threshold based ASIM DNS Solution

Back


Id	4ab8b09e-3c23-4974-afbe-7e653779eb2b
Rulename	Detect excessive NXDOMAIN DNS queries - Static threshold based (ASIM DNS Solution)
Description	This rule generates an alert when the configured threshold for DNS queries to non-existent domains is breached. This helps in identifying possible C2 communications. It utilizes ASIM normalization and is applied to any source that supports the ASIM DNS schema.
Severity	Medium
Tactics	CommandAndControl
Techniques	T1568 T1008
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/DNS Essentials/Analytic Rules/ExcessiveNXDOMAINDNSQueriesStaticThresholdBased.yaml
Version	1.0.2
Arm template	4ab8b09e-3c23-4974-afbe-7e653779eb2b.json

KQL

let lookback = 1h;
let threshold = 200;
_Im_Dns(starttime=ago(lookback), responsecodename='NXDOMAIN')
| summarize NXDOMAINCount=count() by SrcIpAddr, bin(TimeGenerated, 15m)
| where NXDOMAINCount > threshold
| join kind=inner (_Im_Dns(starttime=ago(lookback), responsecodename='NXDOMAIN')
  | summarize DNSQueries = makeset(DnsQuery) by SrcIpAddr)
  on SrcIpAddr
| extend NXDOMAINthreshold=threshold
| project-away SrcIpAddr1

YAML

customDetails:
  NXDOMAINthreshold: NXDOMAINthreshold
  NXDOMAINCount: NXDOMAINCount
  DNSQueries: DNSQueries
alertDetailsOverride:
  alertDisplayNameFormat: "[Static threshold] Excessive NXDOMAIN DNS Queries has been detected from client IP: '{{SrcIpAddr}}'"
  alertDescriptionFormat: |-
    Client is generating excessive amount of DNS queries for non-existent domains. This can be an indication of possible C2 communications. 

    'NXDOMAIN' error count threshold: '{{NXDOMAINthreshold}}'

    Current 'NXDOMAIN' error count from this client: '{{NXDOMAINCount}}'

    DNS queries requested by the client include:

    '{{DNSQueries}}'    
queryFrequency: 1h
queryPeriod: 1h
status: Available
kind: Scheduled
tactics:
- CommandAndControl
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/DNS Essentials/Analytic Rules/ExcessiveNXDOMAINDNSQueriesStaticThresholdBased.yaml
eventGroupingSettings:
  aggregationKind: AlertPerResult
version: 1.0.2
triggerThreshold: 0
description: |
    'This rule generates an alert when the configured threshold for DNS queries to non-existent domains is breached. This helps in identifying possible C2 communications. It utilizes [ASIM](https://aka.ms/AboutASIM) normalization and is applied to any source that supports the ASIM DNS schema.'
severity: Medium
relevantTechniques:
- T1568
- T1008
id: 4ab8b09e-3c23-4974-afbe-7e653779eb2b
name: Detect excessive NXDOMAIN DNS queries - Static threshold based (ASIM DNS Solution)
query: |
  let lookback = 1h;
  let threshold = 200;
  _Im_Dns(starttime=ago(lookback), responsecodename='NXDOMAIN')
  | summarize NXDOMAINCount=count() by SrcIpAddr, bin(TimeGenerated, 15m)
  | where NXDOMAINCount > threshold
  | join kind=inner (_Im_Dns(starttime=ago(lookback), responsecodename='NXDOMAIN')
    | summarize DNSQueries = makeset(DnsQuery) by SrcIpAddr)
    on SrcIpAddr
  | extend NXDOMAINthreshold=threshold
  | project-away SrcIpAddr1  
requiredDataConnectors: []
tags:
- SchemaVersion: 0.1.6
  Schema: ASimDns
entityMappings:
- fieldMappings:
  - identifier: Address
    columnName: SrcIpAddr
  entityType: IP
triggerOperator: gt

ARM