From 57bfcdaf62231450175fe19a06a85b86ec3e8ea7 Mon Sep 17 00:00:00 2001 From: root Date: Thu, 22 Apr 2021 15:47:09 +0000 Subject: [PATCH] Added detection testing service results inExcessive Usage of NSLOOKUP App --- .../excessive_usage_of_nslookup_app.yml | 26 +++++++++++-------- 1 file changed, 15 insertions(+), 11 deletions(-) diff --git a/detections/endpoint/excessive_usage_of_nslookup_app.yml b/detections/endpoint/excessive_usage_of_nslookup_app.yml index 8c440fd9cf..3a2e971cc2 100644 --- a/detections/endpoint/excessive_usage_of_nslookup_app.yml +++ b/detections/endpoint/excessive_usage_of_nslookup_app.yml @@ -6,16 +6,17 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: this search is to detect potential dns exfiltration using nslookup application. This technique are seen in couple of malware and - APT group to exfiltrated collected data in a infected machine or infected network. - This detection is looking for unique use of nslookup where it tries to use specific record type like (TXT, A, AAAA) that are commonly used by attacker - and also the retry parameter which is designed to query C2 DNS multiple tries. -search: '| tstats `security_content_summariesonly` values(Processes.process) as cmdline values(Processes.process_id) as nslookup_procid - values(Processes.parent_process) as parent_cmdline count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where Processes.process_name = "nslookup.exe" - by Processes.dest Processes.user Processes.process_name | where count >= 30 - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` +description: this search is to detect potential dns exfiltration using nslookup application. + This technique are seen in couple of malware and APT group to exfiltrated collected + data in a infected machine or infected network. This detection is looking for unique + use of nslookup where it tries to use specific record type like (TXT, A, AAAA) that + are commonly used by attacker and also the retry parameter which is designed to + query C2 DNS multiple tries. +search: '| tstats `security_content_summariesonly` values(Processes.process) as cmdline + values(Processes.process_id) as nslookup_procid values(Processes.parent_process) + as parent_cmdline count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where Processes.process_name = "nslookup.exe" by Processes.dest Processes.user Processes.process_name + | where count >= 30 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `excessive_usage_of_nslookup_app_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your @@ -47,4 +48,7 @@ tags: - Processes.process_name - Processes.process - Processes.process_id - security_domain: endpoint \ No newline at end of file + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/nslookup_exfil/windows-sysmon.log