admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Added detection testing service results inExcessive Usage of NSLOOKUP App

Browse Source
This commit is contained in:
root
2021-04-22 15:47:09 +00:00
parent 9bb6de8ed2
commit 57bfcdaf62
1 changed files with 15 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/excessive_usage_of_nslookup_app.yml
+15 -11
View File
@@ -6,16 +6,17 @@ author: Teoderick Contreras, Splunk
type: batch
datamodel:
- Endpoint
description: this search is to detect potential dns exfiltration using nslookup application. This technique are seen in couple of malware and
APT group to exfiltrated collected data in a infected machine or infected network.
This detection is looking for unique use of nslookup where it tries to use specific record type like (TXT, A, AAAA) that are commonly used by attacker
and also the retry parameter which is designed to query C2 DNS multiple tries.
search: '| tstats `security_content_summariesonly` values(Processes.process) as cmdline values(Processes.process_id) as nslookup_procid
values(Processes.parent_process) as parent_cmdline count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
where Processes.process_name = "nslookup.exe"
by Processes.dest Processes.user Processes.process_name | where count >= 30
| `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)`
description: this search is to detect potential dns exfiltration using nslookup application.
This technique are seen in couple of malware and APT group to exfiltrated collected
data in a infected machine or infected network. This detection is looking for unique
use of nslookup where it tries to use specific record type like (TXT, A, AAAA) that
are commonly used by attacker and also the retry parameter which is designed to
query C2 DNS multiple tries.
search: '| tstats `security_content_summariesonly` values(Processes.process) as cmdline
values(Processes.process_id) as nslookup_procid values(Processes.parent_process)
as parent_cmdline count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
where Processes.process_name = "nslookup.exe" by Processes.dest Processes.user Processes.process_name
| where count >= 30 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`| `excessive_usage_of_nslookup_app_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
@@ -47,4 +48,7 @@ tags:
- Processes.process_name
- Processes.process
- Processes.process_id
security_domain: endpoint
security_domain: endpoint
automated_detection_testing: passed
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/nslookup_exfil/windows-sysmon.log