Corelight - C2 DGA Detected Via Repetitive Failures

Back


Id	8eaa2268-74ee-492c-b869-450eff707fef
Rulename	Corelight - C2 DGA Detected Via Repetitive Failures
Description	Detects large amounts of DNS resolution failures.
Severity	Medium
Tactics	CommandAndControl
Techniques	T1568
Required data connectors	Corelight
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Corelight/Analytic Rules/CorelightC2RepetitiveFailures.yaml
Version	2.1.1
Arm template	8eaa2268-74ee-492c-b869-450eff707fef.json

KQL

let threshold = 25;
union corelight_dns, corelight_dns_red
// rcodes: SERVFAIL=2, NXDOMAIN=3
| where rcode in (2, 3)
| summarize count() by query, id_orig_h, bin(TimeGenerated, 5m)
| where count_ > threshold

YAML

queryPeriod: 1h
kind: Scheduled
entityMappings:
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: id_orig_h
requiredDataConnectors:
- connectorId: Corelight
  dataTypes:
  - Corelight_v2_dns
  - Corelight_v2_dns_red
  - corelight_dns
  - corelight_dns_red
description: |
    'Detects large amounts of DNS resolution failures.'
queryFrequency: 1h
triggerOperator: gt
query: |
  let threshold = 25;
  union corelight_dns, corelight_dns_red
  // rcodes: SERVFAIL=2, NXDOMAIN=3
  | where rcode in (2, 3)
  | summarize count() by query, id_orig_h, bin(TimeGenerated, 5m)
  | where count_ > threshold  
name: Corelight - C2 DGA Detected Via Repetitive Failures
id: 8eaa2268-74ee-492c-b869-450eff707fef
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Corelight/Analytic Rules/CorelightC2RepetitiveFailures.yaml
severity: Medium
version: 2.1.1
status: Available
relevantTechniques:
- T1568
triggerThreshold: 0
tactics:
- CommandAndControl

ARM