admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update excessive_usage_of_nslookup_app.yml

Browse Source
This commit is contained in:
Michael Haag
2021-04-23 11:39:51 -06:00
committed by GitHub
parent 57bb490c61
commit 613374b0c8
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/excessive_usage_of_nslookup_app.yml
+2 -2
View File
@@ -6,10 +6,10 @@ author: Teoderick Contreras, Splunk
type: batch
datamodel:
- Endpoint
description: this search is to detect potential dns exfiltration using nslookup application.
description: this search is to detect potential DNS exfiltration using nslookup application.
This technique are seen in couple of malware and APT group to exfiltrated collected
data in a infected machine or infected network. This detection is looking for unique
use of nslookup where it tries to use specific record type like (TXT, A, AAAA) that
use of nslookup where it tries to use specific record type (TXT, A, AAAA) that
are commonly used by attacker and also the retry parameter which is designed to
query C2 DNS multiple tries.
search: '| tstats `security_content_summariesonly` values(Processes.process) as cmdline