Corelight - C2 DGA Detected Via Repetitive Failures

Back


Id	8eaa2268-74ee-492c-b869-450eff707fef
Rulename	Corelight - C2 DGA Detected Via Repetitive Failures
Description	Detects large amounts of DNS resolution failures.
Severity	Medium
Tactics	CommandAndControl
Techniques	T1568
Required data connectors	Corelight
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Corelight/Analytic Rules/CorelightC2RepetitiveFailures.yaml
Version	2.1.1
Arm template	8eaa2268-74ee-492c-b869-450eff707fef.json

KQL

let threshold = 25;
union corelight_dns, corelight_dns_red
// rcodes: SERVFAIL=2, NXDOMAIN=3
| where rcode in (2, 3)
| summarize count() by query, id_orig_h, bin(TimeGenerated, 5m)
| where count_ > threshold

YAML

severity: Medium
queryPeriod: 1h
name: Corelight - C2 DGA Detected Via Repetitive Failures
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Corelight/Analytic Rules/CorelightC2RepetitiveFailures.yaml
entityMappings:
- fieldMappings:
  - columnName: id_orig_h
    identifier: Address
  entityType: IP
version: 2.1.1
relevantTechniques:
- T1568
status: Available
id: 8eaa2268-74ee-492c-b869-450eff707fef
queryFrequency: 1h
triggerThreshold: 0
triggerOperator: gt
query: |
  let threshold = 25;
  union corelight_dns, corelight_dns_red
  // rcodes: SERVFAIL=2, NXDOMAIN=3
  | where rcode in (2, 3)
  | summarize count() by query, id_orig_h, bin(TimeGenerated, 5m)
  | where count_ > threshold  
description: |
    'Detects large amounts of DNS resolution failures.'
requiredDataConnectors:
- connectorId: Corelight
  dataTypes:
  - Corelight_v2_dns
  - Corelight_v2_dns_red
  - corelight_dns
  - corelight_dns_red
tactics:
- CommandAndControl
kind: Scheduled

ARM