Detect DNS queries reporting multiple errors from different clients - Static threshold based ASIM DNS Solution

Back


Id	5b8344eb-fa28-4ac3-bcff-bc19d5d63089
Rulename	Detect DNS queries reporting multiple errors from different clients - Static threshold based (ASIM DNS Solution)
Description	This rule creates an alert when multiple clients report errors for the same DNS query. This helps in identifying possible similar C2 communications originating from different clients. It utilizes ASIM normalization and is applied to any source that supports the ASIM DNS schema.
Severity	Medium
Tactics	CommandAndControl
Techniques	T1568 T1573 T1008
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/DNS Essentials/Analytic Rules/MultipleErrorsReportedForSameDNSQueryStaticThresholdBased.yaml
Version	1.0.3
Arm template	5b8344eb-fa28-4ac3-bcff-bc19d5d63089.json

KQL

let lookback=1h;
let threshold = 2;
let errors = dynamic(['NXDOMAIN', 'SERVFAIL', 'REFUSED']); 
_Im_Dns(starttime=ago(lookback)) 
  | where EventResultDetails has_any (errors) 
  | summarize SrcIPs = make_set(SrcIpAddr, 100), Dvcs = make_set(Dvc, 100), ResourceIds = make_set(_ResourceId, 100) by DnsQuery, bin(TimeGenerated, 10min) 
  | where array_length(SrcIPs) >= threshold 
  | extend TotalIPs = array_length(SrcIPs),IPCountthreshold = threshold 
  | extend DomainName = strcat(split(DnsQuery, ".")[1], ".", split(DnsQuery, ".")[2])  
  | mv-expand SrcIPs  
  | extend SrcIP = tostring(SrcIPs)  
  | mv-expand Dvcs  
  | extend Dvc = tostring(Dvcs)  
  | mv-expand ResourceIds  
  | extend ResourceId = tostring(ResourceIds)  
  | extend Dvc = strcat(split(Dvc, ".")[0])
  | summarize Start=min(TimeGenerated), End=max(TimeGenerated) by SrcIP, Dvc, ResourceId, DnsQuery, DomainName
  | extend HostName = tostring(split(Dvc, ".")[0]), DomainIndex = toint(indexof(Dvc, '.'))
  | extend HostNameDomain = iff(DomainIndex != -1, substring(Dvc, DomainIndex + 1), Dvc)

YAML

relevantTechniques:
- T1568
- T1573
- T1008
name: Detect DNS queries reporting multiple errors from different clients - Static threshold based (ASIM DNS Solution)
requiredDataConnectors: []
entityMappings:
- fieldMappings:
  - identifier: DomainName
    columnName: DnsQuery
  entityType: DNS
- fieldMappings:
  - identifier: Address
    columnName: SrcIP
  entityType: IP
- fieldMappings:
  - identifier: ResourceId
    columnName: ResourceId
  entityType: AzureResource
- fieldMappings:
  - identifier: Url
    columnName: DnsQuery
  entityType: Url
- fieldMappings:
  - identifier: HostName
    columnName: HostName
  - identifier: NTDomain
    columnName: HostNameDomain
  entityType: Host
triggerThreshold: 0
id: 5b8344eb-fa28-4ac3-bcff-bc19d5d63089
tactics:
- CommandAndControl
version: 1.0.3
customDetails:
  SrcIPs: SrcIPs
  TotalIPs: TotalIPs
  IPCountthreshold: IPCountthreshold
queryPeriod: 1h
alertDetailsOverride:
  alertDisplayNameFormat: "[Static threshold] Multiple errors for the same DNS query has been detected - '{{DnsQuery}}'"
  alertDescriptionFormat: |-
    Multiple errors were detected on different clients for the same DNS query. These unsuccessful responses can be an indication of C2 communication. 

    Threshold for total clients reporting errors: '{{IPCountthreshold}}'

    Current count of clients reporting errors for this DNS query: '{{TotalIPs}}'

    Clients requesting this DNSQuery include:

    '{{SrcIPs}}'    
triggerOperator: gt
kind: Scheduled
tags:
- Schema: ASimDns
  SchemaVersion: 0.1.6
eventGroupingSettings:
  aggregationKind: SingleAlert
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/DNS Essentials/Analytic Rules/MultipleErrorsReportedForSameDNSQueryStaticThresholdBased.yaml
queryFrequency: 1h
severity: Medium
status: Available
description: |
    'This rule creates an alert when multiple clients report errors for the same DNS query. This helps in identifying possible similar C2 communications originating from different clients. It utilizes [ASIM](https://aka.ms/AboutASIM) normalization and is applied to any source that supports the ASIM DNS schema.'
query: |
  let lookback=1h;
  let threshold = 2;
  let errors = dynamic(['NXDOMAIN', 'SERVFAIL', 'REFUSED']); 
  _Im_Dns(starttime=ago(lookback)) 
    | where EventResultDetails has_any (errors) 
    | summarize SrcIPs = make_set(SrcIpAddr, 100), Dvcs = make_set(Dvc, 100), ResourceIds = make_set(_ResourceId, 100) by DnsQuery, bin(TimeGenerated, 10min) 
    | where array_length(SrcIPs) >= threshold 
    | extend TotalIPs = array_length(SrcIPs),IPCountthreshold = threshold 
    | extend DomainName = strcat(split(DnsQuery, ".")[1], ".", split(DnsQuery, ".")[2])  
    | mv-expand SrcIPs  
    | extend SrcIP = tostring(SrcIPs)  
    | mv-expand Dvcs  
    | extend Dvc = tostring(Dvcs)  
    | mv-expand ResourceIds  
    | extend ResourceId = tostring(ResourceIds)  
    | extend Dvc = strcat(split(Dvc, ".")[0])
    | summarize Start=min(TimeGenerated), End=max(TimeGenerated) by SrcIP, Dvc, ResourceId, DnsQuery, DomainName
    | extend HostName = tostring(split(Dvc, ".")[0]), DomainIndex = toint(indexof(Dvc, '.'))
    | extend HostNameDomain = iff(DomainIndex != -1, substring(Dvc, DomainIndex + 1), Dvc)

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/5b8344eb-fa28-4ac3-bcff-bc19d5d63089')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/5b8344eb-fa28-4ac3-bcff-bc19d5d63089')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "Multiple errors were detected on different clients for the same DNS query. These unsuccessful responses can be an indication of C2 communication. \n\nThreshold for total clients reporting errors: '{{IPCountthreshold}}'\n\nCurrent count of clients reporting errors for this DNS query: '{{TotalIPs}}'\n\nClients requesting this DNSQuery include:\n\n'{{SrcIPs}}'",
          "alertDisplayNameFormat": "[Static threshold] Multiple errors for the same DNS query has been detected - '{{DnsQuery}}'"
        },
        "alertRuleTemplateName": "5b8344eb-fa28-4ac3-bcff-bc19d5d63089",
        "customDetails": {
          "IPCountthreshold": "IPCountthreshold",
          "SrcIPs": "SrcIPs",
          "TotalIPs": "TotalIPs"
        },
        "description": "'This rule creates an alert when multiple clients report errors for the same DNS query. This helps in identifying possible similar C2 communications originating from different clients. It utilizes [ASIM](https://aka.ms/AboutASIM) normalization and is applied to any source that supports the ASIM DNS schema.'\n",
        "displayName": "Detect DNS queries reporting multiple errors from different clients - Static threshold based (ASIM DNS Solution)",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "DNS",
            "fieldMappings": [
              {
                "columnName": "DnsQuery",
                "identifier": "DomainName"
              }
            ]
          },
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "SrcIP",
                "identifier": "Address"
              }
            ]
          },
          {
            "entityType": "AzureResource",
            "fieldMappings": [
              {
                "columnName": "ResourceId",
                "identifier": "ResourceId"
              }
            ]
          },
          {
            "entityType": "Url",
            "fieldMappings": [
              {
                "columnName": "DnsQuery",
                "identifier": "Url"
              }
            ]
          },
          {
            "entityType": "Host",
            "fieldMappings": [
              {
                "columnName": "HostName",
                "identifier": "HostName"
              },
              {
                "columnName": "HostNameDomain",
                "identifier": "NTDomain"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "SingleAlert"
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/DNS Essentials/Analytic Rules/MultipleErrorsReportedForSameDNSQueryStaticThresholdBased.yaml",
        "query": "let lookback=1h;\nlet threshold = 2;\nlet errors = dynamic(['NXDOMAIN', 'SERVFAIL', 'REFUSED']); \n_Im_Dns(starttime=ago(lookback)) \n  | where EventResultDetails has_any (errors) \n  | summarize SrcIPs = make_set(SrcIpAddr, 100), Dvcs = make_set(Dvc, 100), ResourceIds = make_set(_ResourceId, 100) by DnsQuery, bin(TimeGenerated, 10min) \n  | where array_length(SrcIPs) >= threshold \n  | extend TotalIPs = array_length(SrcIPs),IPCountthreshold = threshold \n  | extend DomainName = strcat(split(DnsQuery, \".\")[1], \".\", split(DnsQuery, \".\")[2])  \n  | mv-expand SrcIPs  \n  | extend SrcIP = tostring(SrcIPs)  \n  | mv-expand Dvcs  \n  | extend Dvc = tostring(Dvcs)  \n  | mv-expand ResourceIds  \n  | extend ResourceId = tostring(ResourceIds)  \n  | extend Dvc = strcat(split(Dvc, \".\")[0])\n  | summarize Start=min(TimeGenerated), End=max(TimeGenerated) by SrcIP, Dvc, ResourceId, DnsQuery, DomainName\n  | extend HostName = tostring(split(Dvc, \".\")[0]), DomainIndex = toint(indexof(Dvc, '.'))\n  | extend HostNameDomain = iff(DomainIndex != -1, substring(Dvc, DomainIndex + 1), Dvc)\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "CommandAndControl"
        ],
        "tags": [
          {
            "Schema": "ASimDns",
            "SchemaVersion": "0.1.6"
          }
        ],
        "techniques": [
          "T1008",
          "T1568",
          "T1573"
        ],
        "templateVersion": "1.0.3",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}