name: Detect hosts connecting to dynamic domain providers
id: c77162d3-f93c-45cc-80c8-22f6v5464g9f
version: 3
date: '2021-01-14'
author: Bhavin Patel, Splunk
type: batch
datamodel:
- Network_Resolution
description: Malicious actors often abuse legitimate Dynamic DNS services to host
  malicious payloads or interactive command and control nodes. Attackers will automate
  domain resolution changes by routing dynamic domains to countless IP addresses to
  circumvent firewall blocks, block lists as well as frustrate a network defenders
  analytic and investigative processes. This search will look for DNS queries made
  from within your infrastructure to suspicious dynamic domains.
search: '| tstats `security_content_summariesonly` count values(DNS.answer) as answer
  min(_time) as firstTime from datamodel=Network_Resolution by DNS.query host | `drop_dm_object_name("DNS")`
  | `security_content_ctime(firstTime)` | `dynamic_dns_providers` | `detect_hosts_connecting_to_dynamic_domain_providers_filter`'
how_to_implement: 'First, you''ll need to ingest data from your DNS operations. This
  can be done by ingesting logs from your server or data, collected passively by Splunk
  Stream or a similar solution. Specifically, data that contains the domain that is
  being queried and the IP of the host originating the request must be populating
  the `Network_Resolution` data model. This search also leverages a lookup file, `dynamic_dns_providers_default.csv`,
  which contains a non-exhaustive list of Dynamic DNS providers. Please consider updating
  the local lookup periodically by adding new domains to the list of `dynamic_dns_providers_local.csv`.\

  This search produces fields (query, answer, isDynDNS) that are not yet supported
  by ES Incident Review and therefore cannot be viewed when a notable event is raised.
  These fields contribute additional context to the notable event. To see the additional
  metadata, add the following fields, if not already present, to Incident Review.
  Event Attributes (Configure > Incident Management > Incident Review Settings > Add
  New Entry):\\n1. **Label:** DNS Query, **Field:** query\

  1. \

  1. **Label:** DNS Answer, **Field:** answer\

  1. \

  1. **Label:** IsDynamicDNS, **Field:** isDynDNS\

  Detailed documentation on how to create a new field within Incident Review may be
  found here: `https://docs.splunk.com/Documentation/ES/5.3.0/Admin/Customizenotables#Add_a_field_to_the_notable_event_details`'
known_false_positives: Some users and applications may leverage Dynamic DNS to reach
  out to some domains on the Internet since dynamic DNS by itself is not malicious,
  however this activity must be verified.
references: []
tags:
  analytic_story:
  - Data Protection
  - Prohibited Traffic Allowed or Protocol Mismatch
  - DNS Hijacking
  - Suspicious DNS Traffic
  - Dynamic DNS
  - Command and Control
  asset_type: Endpoint
  automated_detection_testing: passed
  cis20:
  - CIS 8
  - CIS 12
  - CIS 13
  dataset:
  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1189/dyn_dns_site/windows-sysmon.log
  kill_chain_phases:
  - Command and Control
  - Actions on Objectives
  mitre_attack_id:
  - T1189
  nist:
  - PR.DS
  - PR.PT
  - DE.AE
  - DE.CM
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
  - DNS.answer
  - DNS.query
  - host
  security_domain: network
