author: Bhavin Patel, Splunk
date: '2019-04-01'
description: While investigating, an analyst will want to know what process and parent_process
  is responsible for generating suspicious DNS traffic. Use the following search and
  enter the value of `dest` in the search to get specific details on the process responsible
  for creating the DNS traffic.
how_to_implement: You must be ingesting endpoint data that associates processes with
  network events into the Endpoint datamodel. This can come from endpoint protection
  products such as carbon black, or endpoint data sources such as Sysmon.
id: 910e6512-edc9-4f93-ba24-5b786f47a672
inputs:
- dest
name: Get Process Responsible For The DNS Traffic
search: '| tstats `security_content_summariesonly` count min(_time) max(_time) as
  lastTime from datamodel=Endpoint.Processes by Processes.parent_process Processes.process_name
  Processes.user Processes.dest Processes.process_id | `drop_dm_object_name(Processes)`
  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | search
  dest = $dest$ | join dest type=inner [| tstats `security_content_summariesonly`
  count from datamodel=Endpoint.Ports where Ports.dest_port=53 by Ports.process_id
  Ports.src | `drop_dm_object_name(Ports)` | rename src as dest]'
tags:
  analytic_story:
  - AWS Network ACL Activity
  - Brand Monitoring
  - Command and Control
  - Data Protection
  - Dynamic DNS
  - Hidden Cobra Malware
  - Suspicious AWS Traffic
  - Suspicious DNS Traffic
  product:
  - Splunk Phantom
type: response
version: 2
