Corelight - C2 DGA Detected Via Repetitive Failures

Back


Id	8eaa2268-74ee-492c-b869-450eff707fef
Rulename	Corelight - C2 DGA Detected Via Repetitive Failures
Description	Detects large amounts of DNS resolution failures.
Severity	Medium
Tactics	CommandAndControl
Techniques	T1568
Required data connectors	Corelight
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Corelight/Analytic Rules/CorelightC2RepetitiveFailures.yaml
Version	2.1.1
Arm template	8eaa2268-74ee-492c-b869-450eff707fef.json

KQL

let threshold = 25;
union corelight_dns, corelight_dns_red
// rcodes: SERVFAIL=2, NXDOMAIN=3
| where rcode in (2, 3)
| summarize count() by query, id_orig_h, bin(TimeGenerated, 5m)
| where count_ > threshold

YAML

query: |
  let threshold = 25;
  union corelight_dns, corelight_dns_red
  // rcodes: SERVFAIL=2, NXDOMAIN=3
  | where rcode in (2, 3)
  | summarize count() by query, id_orig_h, bin(TimeGenerated, 5m)
  | where count_ > threshold  
description: |
    'Detects large amounts of DNS resolution failures.'
triggerOperator: gt
triggerThreshold: 0
queryPeriod: 1h
queryFrequency: 1h
entityMappings:
- entityType: IP
  fieldMappings:
  - columnName: id_orig_h
    identifier: Address
name: Corelight - C2 DGA Detected Via Repetitive Failures
status: Available
id: 8eaa2268-74ee-492c-b869-450eff707fef
tactics:
- CommandAndControl
kind: Scheduled
requiredDataConnectors:
- connectorId: Corelight
  dataTypes:
  - Corelight_v2_dns
  - Corelight_v2_dns_red
  - corelight_dns
  - corelight_dns_red
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Corelight/Analytic Rules/CorelightC2RepetitiveFailures.yaml
version: 2.1.1
severity: Medium
relevantTechniques:
- T1568

ARM