name: DNS record changed
id: 44d3a43e-dcd5-49f7-8356-5209bb369065
version: 3
date: '2020-07-21'
author: Jose Hernandez, Splunk
type: batch
datamodel:
- Network_Resolution
description: The search takes the DNS records and their answers results of the discovered_dns_records
  lookup and finds if any records have changed by searching DNS response from the
  Network_Resolution datamodel across the last day.
search: '| inputlookup discovered_dns_records | rename answer as discovered_answer
  | join domain[|tstats `security_content_summariesonly` count values(DNS.record_type)
  as type, values(DNS.answer) as current_answer values(DNS.src) as src from datamodel=Network_Resolution
  where DNS.message_type=RESPONSE DNS.answer!="unknown" DNS.answer!="" by DNS.query
  | rename DNS.query as query | where query!="unknown" | rex field=query "(?<domain>\w+\.\w+?)(?:$|/)"]
  | makemv delim=" " answer |  makemv delim=" " type | sort -count | table count,src,domain,type,query,current_answer,discovered_answer
  | makemv current_answer  | mvexpand current_answer | makemv discovered_answer |
  eval n=mvfind(discovered_answer, current_answer) | where isnull(n) | `dns_record_changed_filter`'
how_to_implement: "To successfully implement this search you will need to ensure that\
  \ DNS data is populating the `Network_Resolution` data model. It also requires that\
  \ the `discover_dns_record` lookup table be populated by the included support search\
  \ \"Discover DNS record\". \\\n **Splunk>Phantom Playbook Integration**\\\nIf Splunk>Phantom\
  \ is also configured in your environment, a Playbook called \"DNS Hijack Enrichment\"\
  \ can be configured to run when any results are found by this detection search.\
  \ The playbook takes in the DNS record changed and uses Geoip, whois, Censys and\
  \ PassiveTotal to detect if DNS issuers changed. To use this integration, install\
  \ the Phantom App for Splunk `https://splunkbase.splunk.com/app/3411/`, add the\
  \ correct hostname to the \"Phantom Instance\" field in the Adaptive Response Actions\
  \ when configuring this detection search, and set the corresponding Playbook to\
  \ active. \\\n(Playbook Link:`https://my.phantom.us/4.2/playbook/dns-hijack-enrichment/`).\\\
  \n"
known_false_positives: Legitimate DNS changes can be detected in this search. Investigate,
  verify and update the list of provided current answers for the domains in question
  as appropriate.
references: []
tags:
  analytic_story:
  - DNS Hijacking
  asset_type: Endpoint
  cis20:
  - CIS 1
  - CIS 3
  - CIS 8
  - CIS 12
  kill_chain_phases:
  - Command and Control
  mitre_attack_id:
  - T1071.004
  nist:
  - ID.AM
  - PR.DS
  - PR.IP
  - DE.AE
  - DE.CM
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
  - DNS.record_type
  - DNS.answer
  - DNS.src
  - DNS.message_type
  - DNS.query
  security_domain: network
