admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Branch was auto-updated.

Browse Source
This commit is contained in:
pyth0n1c
2022-02-15 10:50:10 -08:00
committed by GitHub
parent 283013b9a0 089b125c54
commit 47d52db7aa
1 changed files with 9 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/deprecated/detection_of_dns_tunnels.yml
+9 -2
View File
@@ -1,7 +1,7 @@
name: Detection of DNS Tunnels
id: 104658f4-afdc-499f-9719-17a43f9826f4
version: 2
date: '2017-09-18'
date: '2022-02-15'
author: Bhavin Patel, Splunk
type: TTP
datamodel:
@@ -12,7 +12,14 @@ description: This search is used to detect DNS tunneling, by calculating the sum
originating from internal DNS, Web, and Email servers. Endpoints using DNS as a
method of transmission for data exfiltration, command and control, or evasion of
security controls can often be detected by noting an unusually large volume of DNS
traffic. Deprecated because existing detection is doing the same.
traffic. \
NOTE:Deprecated because existing detection is doing the same. This detection is
replaced with two other variations, if you are using MLTK then you can use this
search `ESCU - DNS Query Length Outliers - MLTK - Rule` or use the standard
deviation version `ESCU - DNS Query Length With High Standard Deviation - Rule`,
as an alternantive.
search: '| tstats `security_content_summariesonly` dc("DNS.query") as count from
datamodel=Network_Resolution where nodename=DNS "DNS.message_type"="QUERY" NOT
(`cim_corporate_web_domain_search("DNS.query")`) NOT "DNS.query"="*.in-addr.arpa"