Corelight - C2 DGA Detected Via Repetitive Failures

Back


Id	8eaa2268-74ee-492c-b869-450eff707fef
Rulename	Corelight - C2 DGA Detected Via Repetitive Failures
Description	Detects large amounts of DNS resolution failures.
Severity	Medium
Tactics	CommandAndControl
Techniques	T1568
Required data connectors	Corelight
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Corelight/Analytic Rules/CorelightC2RepetitiveFailures.yaml
Version	2.1.1
Arm template	8eaa2268-74ee-492c-b869-450eff707fef.json

KQL

let threshold = 25;
union corelight_dns, corelight_dns_red
// rcodes: SERVFAIL=2, NXDOMAIN=3
| where rcode in (2, 3)
| summarize count() by query, id_orig_h, bin(TimeGenerated, 5m)
| where count_ > threshold

YAML

description: |
    'Detects large amounts of DNS resolution failures.'
entityMappings:
- fieldMappings:
  - columnName: id_orig_h
    identifier: Address
  entityType: IP
query: |
  let threshold = 25;
  union corelight_dns, corelight_dns_red
  // rcodes: SERVFAIL=2, NXDOMAIN=3
  | where rcode in (2, 3)
  | summarize count() by query, id_orig_h, bin(TimeGenerated, 5m)
  | where count_ > threshold  
tactics:
- CommandAndControl
severity: Medium
triggerThreshold: 0
queryFrequency: 1h
status: Available
queryPeriod: 1h
relevantTechniques:
- T1568
id: 8eaa2268-74ee-492c-b869-450eff707fef
name: Corelight - C2 DGA Detected Via Repetitive Failures
kind: Scheduled
triggerOperator: gt
version: 2.1.1
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Corelight/Analytic Rules/CorelightC2RepetitiveFailures.yaml
requiredDataConnectors:
- dataTypes:
  - Corelight_v2_dns
  - Corelight_v2_dns_red
  - corelight_dns
  - corelight_dns_red
  connectorId: Corelight

ARM