Corelight - C2 DGA Detected Via Repetitive Failures

Back


Id	8eaa2268-74ee-492c-b869-450eff707fef
Rulename	Corelight - C2 DGA Detected Via Repetitive Failures
Description	Detects large amounts of DNS resolution failures.
Severity	Medium
Tactics	CommandAndControl
Techniques	T1568
Required data connectors	Corelight
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Corelight/Analytic Rules/CorelightC2RepetitiveFailures.yaml
Version	2.1.1
Arm template	8eaa2268-74ee-492c-b869-450eff707fef.json

KQL

let threshold = 25;
union corelight_dns, corelight_dns_red
// rcodes: SERVFAIL=2, NXDOMAIN=3
| where rcode in (2, 3)
| summarize count() by query, id_orig_h, bin(TimeGenerated, 5m)
| where count_ > threshold

YAML

relevantTechniques:
- T1568
queryPeriod: 1h
triggerOperator: gt
version: 2.1.1
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Corelight/Analytic Rules/CorelightC2RepetitiveFailures.yaml
description: |
    'Detects large amounts of DNS resolution failures.'
tactics:
- CommandAndControl
severity: Medium
status: Available
kind: Scheduled
triggerThreshold: 0
queryFrequency: 1h
requiredDataConnectors:
- dataTypes:
  - Corelight_v2_dns
  - Corelight_v2_dns_red
  - corelight_dns
  - corelight_dns_red
  connectorId: Corelight
entityMappings:
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: id_orig_h
id: 8eaa2268-74ee-492c-b869-450eff707fef
query: |
  let threshold = 25;
  union corelight_dns, corelight_dns_red
  // rcodes: SERVFAIL=2, NXDOMAIN=3
  | where rcode in (2, 3)
  | summarize count() by query, id_orig_h, bin(TimeGenerated, 5m)
  | where count_ > threshold  
name: Corelight - C2 DGA Detected Via Repetitive Failures

ARM