name: Detect Windows DNS SIGRed via Splunk Stream
id: babd8d10-d073-11ea-87d0-0242ac130003
version: 1
date: '2020-07-28'
author: Shannon Davis, Splunk
type: batch
datamodel: []
description: This search detects SIGRed via Splunk Stream.
search: '`stream_dns` | spath "query_type{}" | search "query_type{}" IN (SIG,KEY)
  | spath protocol_stack | search protocol_stack="ip:tcp:dns" | append [search `stream_tcp`
  bytes_out>65000] | `detect_windows_dns_sigred_via_splunk_stream_filter` | stats
  count by flow_id | where count>1 | fields - count'
how_to_implement: You must be ingesting Splunk Stream DNS and Splunk Stream TCP. We
  are detecting SIG and KEY records via stream:dns and TCP payload over 65KB in size
  via stream:tcp.  Replace the macro definitions ('stream:dns' and 'stream:tcp') with
  configurations for your Splunk environment.
known_false_positives: unknown
references:
- https://research.checkpoint.com/2020/resolving-your-way-into-domain-admin-exploiting-a-17-year-old-bug-in-windows-dns-servers/
tags:
  analytic_story:
  - Windows DNS SIGRed CVE-2020-1350
  asset_type: Endpoint
  cis20:
  - CIS 8
  - CIS 12
  kill_chain_phases:
  - Exploitation
  mitre_attack_id:
  - T1203
  nist:
  - DE.CM
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
  security_domain: network
