Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

Rare client observed with high reverse DNS lookup count - Static threshold based ASIM DNS Solution

Back
Id77b7c820-5f60-4779-8bdb-f06e21add5f1
RulenameRare client observed with high reverse DNS lookup count - Static threshold based (ASIM DNS Solution)
DescriptionThis rule identifies clients with high reverse DNS counts, which could be carrying out reconnaissance or discovery activity. This helps in detecting the possible initial phases of an attack, like discovery and reconnaissance. It utilizes ASIM normalization and is applied to any source that supports the ASIM DNS schema.
SeverityMedium
TacticsReconnaissance
TechniquesT1590
KindScheduled
Query frequency1d
Query period10d
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/DNS Essentials/Analytic Rules/RareClientObservedWithHighReverseDNSLookupCountStaticThresholdBased.yaml
Version1.0.2
Arm template77b7c820-5f60-4779-8bdb-f06e21add5f1.json
Deploy To Azure
let threshold = 10;
let stime = 10d;
let etime = 1d;
let SearchDomain = dynamic(["in-addr.arpa"]);
_Im_Dns(starttime=ago(etime), domain_has_any=SearchDomain)
| summarize
  StartTimeUtc = min(TimeGenerated),
  EndTimeUtc = max(TimeGenerated),
  DNSQueryCount=dcount(DnsQuery)
  by SrcIpAddr
| where DNSQueryCount > threshold
| project StartTimeUtc, EndTimeUtc, SrcIpAddr, DNSQueryCount 
| join kind=leftanti (_Im_Dns(starttime=ago(stime), endtime=ago(etime), domain_has_any=SearchDomain)
  | summarize DNSQueryCount=dcount(DnsQuery) by SrcIpAddr, bin(TimeGenerated, 1d)
  | where DNSQueryCount > threshold
  | project SrcIpAddr, DNSQueryCount
  )
  on SrcIpAddr
| join kind=inner (_Im_Dns(starttime=ago(etime), domain_has_any=SearchDomain)
  | summarize DNSQueries=make_set(DnsQuery, 1000) by SrcIpAddr)
  on SrcIpAddr
| extend DNSQuerythreshold = threshold
| project-away SrcIpAddr1
id: 77b7c820-5f60-4779-8bdb-f06e21add5f1
name: Rare client observed with high reverse DNS lookup count - Static threshold based (ASIM DNS Solution)
triggerOperator: gt
status: Available
queryFrequency: 1d
query: |
  let threshold = 10;
  let stime = 10d;
  let etime = 1d;
  let SearchDomain = dynamic(["in-addr.arpa"]);
  _Im_Dns(starttime=ago(etime), domain_has_any=SearchDomain)
  | summarize
    StartTimeUtc = min(TimeGenerated),
    EndTimeUtc = max(TimeGenerated),
    DNSQueryCount=dcount(DnsQuery)
    by SrcIpAddr
  | where DNSQueryCount > threshold
  | project StartTimeUtc, EndTimeUtc, SrcIpAddr, DNSQueryCount 
  | join kind=leftanti (_Im_Dns(starttime=ago(stime), endtime=ago(etime), domain_has_any=SearchDomain)
    | summarize DNSQueryCount=dcount(DnsQuery) by SrcIpAddr, bin(TimeGenerated, 1d)
    | where DNSQueryCount > threshold
    | project SrcIpAddr, DNSQueryCount
    )
    on SrcIpAddr
  | join kind=inner (_Im_Dns(starttime=ago(etime), domain_has_any=SearchDomain)
    | summarize DNSQueries=make_set(DnsQuery, 1000) by SrcIpAddr)
    on SrcIpAddr
  | extend DNSQuerythreshold = threshold
  | project-away SrcIpAddr1  
queryPeriod: 10d
requiredDataConnectors: []
severity: Medium
tags:
- Schema: ASimDns
  SchemaVersion: 0.1.6
customDetails:
  DNSQuerythreshold: DNSQuerythreshold
  DNSQueries: DNSQueries
  DNSQueryCount: DNSQueryCount
relevantTechniques:
- T1590
alertDetailsOverride:
  alertDescriptionFormat: |-
    Client identified as making high reverse DNS counts which could be carrying out reconnaissance or discovery activity.

    Reverse DNS lookup threshold is: '{{DNSQuerythreshold}}'

    Current reverse DNS lookup count from this client is : '{{DNSQueryCount}}'

    DNS queries requested by this client inlcude: '{{DNSQueries}}'    
  alertDisplayNameFormat: "[Static threshold] Rare client has been observed as making high reverse DNS lookup count  - client IP: '{{SrcIpAddr}}'"
eventGroupingSettings:
  aggregationKind: AlertPerResult
kind: Scheduled
tactics:
- Reconnaissance
triggerThreshold: 0
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/DNS Essentials/Analytic Rules/RareClientObservedWithHighReverseDNSLookupCountStaticThresholdBased.yaml
entityMappings:
- fieldMappings:
  - identifier: Address
    columnName: SrcIpAddr
  entityType: IP
description: |
    'This rule identifies clients with high reverse DNS counts, which could be carrying out reconnaissance or discovery activity. This helps in detecting the possible initial phases of an attack, like discovery and reconnaissance. It utilizes [ASIM](https://aka.ms/AboutASIM) normalization and is applied to any source that supports the ASIM DNS schema.'
version: 1.0.2
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/77b7c820-5f60-4779-8bdb-f06e21add5f1')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/77b7c820-5f60-4779-8bdb-f06e21add5f1')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "Client identified as making high reverse DNS counts which could be carrying out reconnaissance or discovery activity.\n\nReverse DNS lookup threshold is: '{{DNSQuerythreshold}}'\n\nCurrent reverse DNS lookup count from this client is : '{{DNSQueryCount}}'\n\nDNS queries requested by this client inlcude: '{{DNSQueries}}'",
          "alertDisplayNameFormat": "[Static threshold] Rare client has been observed as making high reverse DNS lookup count  - client IP: '{{SrcIpAddr}}'"
        },
        "alertRuleTemplateName": "77b7c820-5f60-4779-8bdb-f06e21add5f1",
        "customDetails": {
          "DNSQueries": "DNSQueries",
          "DNSQueryCount": "DNSQueryCount",
          "DNSQuerythreshold": "DNSQuerythreshold"
        },
        "description": "'This rule identifies clients with high reverse DNS counts, which could be carrying out reconnaissance or discovery activity. This helps in detecting the possible initial phases of an attack, like discovery and reconnaissance. It utilizes [ASIM](https://aka.ms/AboutASIM) normalization and is applied to any source that supports the ASIM DNS schema.'\n",
        "displayName": "Rare client observed with high reverse DNS lookup count - Static threshold based (ASIM DNS Solution)",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "SrcIpAddr",
                "identifier": "Address"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/DNS Essentials/Analytic Rules/RareClientObservedWithHighReverseDNSLookupCountStaticThresholdBased.yaml",
        "query": "let threshold = 10;\nlet stime = 10d;\nlet etime = 1d;\nlet SearchDomain = dynamic([\"in-addr.arpa\"]);\n_Im_Dns(starttime=ago(etime), domain_has_any=SearchDomain)\n| summarize\n  StartTimeUtc = min(TimeGenerated),\n  EndTimeUtc = max(TimeGenerated),\n  DNSQueryCount=dcount(DnsQuery)\n  by SrcIpAddr\n| where DNSQueryCount > threshold\n| project StartTimeUtc, EndTimeUtc, SrcIpAddr, DNSQueryCount \n| join kind=leftanti (_Im_Dns(starttime=ago(stime), endtime=ago(etime), domain_has_any=SearchDomain)\n  | summarize DNSQueryCount=dcount(DnsQuery) by SrcIpAddr, bin(TimeGenerated, 1d)\n  | where DNSQueryCount > threshold\n  | project SrcIpAddr, DNSQueryCount\n  )\n  on SrcIpAddr\n| join kind=inner (_Im_Dns(starttime=ago(etime), domain_has_any=SearchDomain)\n  | summarize DNSQueries=make_set(DnsQuery, 1000) by SrcIpAddr)\n  on SrcIpAddr\n| extend DNSQuerythreshold = threshold\n| project-away SrcIpAddr1\n",
        "queryFrequency": "P1D",
        "queryPeriod": "P10D",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Reconnaissance"
        ],
        "tags": [
          {
            "Schema": "ASimDns",
            "SchemaVersion": "0.1.6"
          }
        ],
        "techniques": [
          "T1590"
        ],
        "templateVersion": "1.0.2",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}