From 085cec0b0dd3a0db526a6970c5b2a9c8759472de Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Tue, 15 Feb 2022 10:26:12 -0800 Subject: [PATCH 1/3] adding note --- detections/deprecated/detection_of_dns_tunnels.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/deprecated/detection_of_dns_tunnels.yml b/detections/deprecated/detection_of_dns_tunnels.yml index 5ca1917571..b9da4ebe44 100644 --- a/detections/deprecated/detection_of_dns_tunnels.yml +++ b/detections/deprecated/detection_of_dns_tunnels.yml @@ -1,7 +1,7 @@ name: Detection of DNS Tunnels id: 104658f4-afdc-499f-9719-17a43f9826f4 version: 2 -date: '2017-09-18' +date: '2022-02-15' author: Bhavin Patel, Splunk type: TTP datamodel: @@ -12,7 +12,7 @@ description: This search is used to detect DNS tunneling, by calculating the sum originating from internal DNS, Web, and Email servers. Endpoints using DNS as a method of transmission for data exfiltration, command and control, or evasion of security controls can often be detected by noting an unusually large volume of DNS - traffic. Deprecated because existing detection is doing the same. + traffic. Deprecated because existing detection is doing the same. This detection is replaced with two other variations, if you are using MLTK then you can use this search `ESCU - DNS Query Length Outliers - MLTK - Rule` or use the standard deviation version `ESCU - DNS Query Length With High Standard Deviation - Rule`, as an alternantive. search: '| tstats `security_content_summariesonly` dc("DNS.query") as count from datamodel=Network_Resolution where nodename=DNS "DNS.message_type"="QUERY" NOT (`cim_corporate_web_domain_search("DNS.query")`) NOT "DNS.query"="*.in-addr.arpa" From e99b973973d7319133f9c3cebff514339de5f0f2 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Tue, 15 Feb 2022 10:27:42 -0800 Subject: [PATCH 2/3] note updadte --- detections/deprecated/detection_of_dns_tunnels.yml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/detections/deprecated/detection_of_dns_tunnels.yml b/detections/deprecated/detection_of_dns_tunnels.yml index b9da4ebe44..e4f375c014 100644 --- a/detections/deprecated/detection_of_dns_tunnels.yml +++ b/detections/deprecated/detection_of_dns_tunnels.yml @@ -12,7 +12,10 @@ description: This search is used to detect DNS tunneling, by calculating the sum originating from internal DNS, Web, and Email servers. Endpoints using DNS as a method of transmission for data exfiltration, command and control, or evasion of security controls can often be detected by noting an unusually large volume of DNS - traffic. Deprecated because existing detection is doing the same. This detection is replaced with two other variations, if you are using MLTK then you can use this search `ESCU - DNS Query Length Outliers - MLTK - Rule` or use the standard deviation version `ESCU - DNS Query Length With High Standard Deviation - Rule`, as an alternantive. + traffic. \ + + NOTE:Deprecated because existing detection is doing the same. This detection is replaced with two other variations, if you are using MLTK then you can use this search `ESCU - DNS Query Length Outliers - MLTK - Rule` or use the standard deviation version `ESCU - DNS Query Length With High Standard Deviation - Rule`, as an alternantive. + search: '| tstats `security_content_summariesonly` dc("DNS.query") as count from datamodel=Network_Resolution where nodename=DNS "DNS.message_type"="QUERY" NOT (`cim_corporate_web_domain_search("DNS.query")`) NOT "DNS.query"="*.in-addr.arpa" From b42ec08d8580ab5e2043b2c1e8c001ec3f860dd3 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Tue, 15 Feb 2022 10:39:23 -0800 Subject: [PATCH 3/3] Fixed spacing on detection_of_dns_tunnels.yml Added line was too long. --- detections/deprecated/detection_of_dns_tunnels.yml | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/detections/deprecated/detection_of_dns_tunnels.yml b/detections/deprecated/detection_of_dns_tunnels.yml index e4f375c014..218429fef1 100644 --- a/detections/deprecated/detection_of_dns_tunnels.yml +++ b/detections/deprecated/detection_of_dns_tunnels.yml @@ -14,7 +14,11 @@ description: This search is used to detect DNS tunneling, by calculating the sum security controls can often be detected by noting an unusually large volume of DNS traffic. \ - NOTE:Deprecated because existing detection is doing the same. This detection is replaced with two other variations, if you are using MLTK then you can use this search `ESCU - DNS Query Length Outliers - MLTK - Rule` or use the standard deviation version `ESCU - DNS Query Length With High Standard Deviation - Rule`, as an alternantive. + NOTE:Deprecated because existing detection is doing the same. This detection is + replaced with two other variations, if you are using MLTK then you can use this + search `ESCU - DNS Query Length Outliers - MLTK - Rule` or use the standard + deviation version `ESCU - DNS Query Length With High Standard Deviation - Rule`, + as an alternantive. search: '| tstats `security_content_summariesonly` dc("DNS.query") as count from datamodel=Network_Resolution where nodename=DNS "DNS.message_type"="QUERY" NOT