From 970648ad697e102172f2e624316455d80aa666cc Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Wed, 9 Mar 2022 14:10:50 -0800 Subject: [PATCH] Large number of changes to the format of datamodels in searches. This is in support of the script to automatically parse searches in order to pull out required fields and datamodels used or not used in a search. --- ...lly_high_number_of_cloud_infrastructure_api_calls.yml | 4 ++-- ...lly_high_number_of_cloud_security_group_api_calls.yml | 2 +- ...s_account_activity_from_previously_unseen_account.yml | 2 +- ...cloud_api_calls_from_previously_unseen_user_roles.yml | 2 +- ...ompute_instance_created_by_previously_unseen_user.yml | 2 +- ...pute_instance_created_in_previously_unused_region.yml | 2 +- ...ute_instance_created_with_previously_unseen_image.yml | 2 +- ...ance_created_with_previously_unseen_instance_type.yml | 2 +- ...oud_instance_modified_with_previously_unseen_user.yml | 2 +- .../cloud_provisioning_from_previously_unseen_city.yml | 2 +- ...cloud_provisioning_from_previously_unseen_country.yml | 2 +- ...ud_provisioning_from_previously_unseen_ip_address.yml | 2 +- .../cloud_provisioning_from_previously_unseen_region.yml | 2 +- .../cloud/detect_aws_console_login_by_new_user.yml | 2 +- .../detect_aws_console_login_by_user_from_new_city.yml | 2 +- ...detect_aws_console_login_by_user_from_new_country.yml | 2 +- .../detect_aws_console_login_by_user_from_new_region.yml | 2 +- .../detect_excessive_account_lockouts_from_endpoint.yml | 9 ++++----- .../java_class_file_download_by_java_user_agent.yml | 2 +- .../potentially_malicious_code_on_commandline.yml | 2 +- detections/endpoint/short_lived_windows_accounts.yml | 2 +- ...tect_hosts_connecting_to_dynamic_domain_providers.yml | 2 +- .../dns_query_length_with_high_standard_deviation.yml | 2 +- 23 files changed, 27 insertions(+), 28 deletions(-) diff --git a/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml b/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml index df978db766..6025bbdde9 100644 --- a/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml +++ b/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml @@ -5,10 +5,10 @@ date: '2020-09-07' author: David Dorsey, Splunk type: Anomaly datamodel: -- Change +- Change.All_Changes description: This search will detect a spike in the number of API calls made to your cloud infrastructure environment by a user. -search: '| tstats count as api_calls values(All_Changes.command) as command from datamodel=Change +search: '| tstats count as api_calls values(All_Changes.command) as command from datamodel=Change.All_Changes where All_Changes.user!=unknown All_Changes.status=success by All_Changes.user _time span=1h | `drop_dm_object_name("All_Changes")` | eval HourOfDay=strftime(_time, "%H") | eval HourOfDay=floor(HourOfDay/4)*4 | eval DayOfWeek=strftime(_time, "%w") diff --git a/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml b/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml index cb1a2b9c7a..30100483c7 100644 --- a/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml +++ b/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml @@ -9,7 +9,7 @@ datamodel: description: This search will detect a spike in the number of API calls made to your cloud infrastructure environment about security groups by a user. search: '| tstats count as security_group_api_calls values(All_Changes.command) as - command from datamodel=Change where All_Changes.object_category=firewall AND All_Changes.status=success + command from datamodel=Change.All_Changes where All_Changes.object_category=firewall AND All_Changes.status=success by All_Changes.user _time span=1h | `drop_dm_object_name("All_Changes")` | eval HourOfDay=strftime(_time, "%H") | eval HourOfDay=floor(HourOfDay/4)*4 | eval DayOfWeek=strftime(_time, "%w") | eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek <= 5, 0, 1) | join user HourOfDay diff --git a/detections/cloud/aws_cross_account_activity_from_previously_unseen_account.yml b/detections/cloud/aws_cross_account_activity_from_previously_unseen_account.yml index e33d221a8b..677fc3cbd7 100644 --- a/detections/cloud/aws_cross_account_activity_from_previously_unseen_account.yml +++ b/detections/cloud/aws_cross_account_activity_from_previously_unseen_account.yml @@ -8,7 +8,7 @@ datamodel: - Authentication description: This search looks for AssumeRole events where an IAM role in a different account is requested for the first time. -search: '| tstats min(_time) as firstTime max(_time) as lastTime from datamodel=Authentication +search: '| tstats min(_time) as firstTime max(_time) as lastTime from datamodel=Authentication.Authentication where Authentication.signature=AssumeRole by Authentication.vendor_account Authentication.user Authentication.src Authentication.user_role | `drop_dm_object_name(Authentication)` | rex field=user_role "arn:aws:sts:*:(?.*):" | where vendor_account diff --git a/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml b/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml index f49fce8cf9..b8ec68216c 100644 --- a/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml +++ b/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml @@ -7,7 +7,7 @@ type: Anomaly datamodel: - Change description: This search looks for new commands from each user role. -search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime from datamodel=Change +search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime from datamodel=Change.All_Changes where All_Changes.user_type=AssumedRole AND All_Changes.status=success by All_Changes.user, All_Changes.command All_Changes.object | `drop_dm_object_name("All_Changes")` | lookup previously_seen_cloud_api_calls_per_user_role user as user, command as command diff --git a/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml b/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml index 0410a7370e..6caa388503 100644 --- a/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml +++ b/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml @@ -9,7 +9,7 @@ datamodel: description: This search looks for cloud compute instances created by users who have not created them before. search: '| tstats `security_content_summariesonly` count earliest(_time) as firstTime, - latest(_time) as lastTime values(All_Changes.object) as dest from datamodel=Change + latest(_time) as lastTime values(All_Changes.object) as dest from datamodel=Change.All_Changes where All_Changes.action=created by All_Changes.user All_Changes.vendor_region | `drop_dm_object_name("All_Changes")` | lookup previously_seen_cloud_compute_creations_by_user user as user OUTPUTNEW firstTimeSeen, enough_data | eventstats max(enough_data) diff --git a/detections/cloud/cloud_compute_instance_created_in_previously_unused_region.yml b/detections/cloud/cloud_compute_instance_created_in_previously_unused_region.yml index f61886e671..c963597bcb 100644 --- a/detections/cloud/cloud_compute_instance_created_in_previously_unused_region.yml +++ b/detections/cloud/cloud_compute_instance_created_in_previously_unused_region.yml @@ -10,7 +10,7 @@ description: This search looks at cloud-infrastructure events where an instance created in any region within the last hour and then compares it to a lookup file of previously seen regions where instances have been created. search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime values(All_Changes.object_id) - as dest, count from datamodel=Change where All_Changes.action=created by All_Changes.vendor_region, + as dest, count from datamodel=Change.All_Changes where All_Changes.action=created by All_Changes.vendor_region, All_Changes.user | `drop_dm_object_name("All_Changes")` | lookup previously_seen_cloud_regions vendor_region as vendor_region OUTPUTNEW firstTimeSeen, enough_data | eventstats max(enough_data) as enough_data | where enough_data=1 | eval firstTimeSeenRegion=min(firstTimeSeen) diff --git a/detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml b/detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml index 5b4851a0ae..7b09b5e0f6 100644 --- a/detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml +++ b/detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml @@ -9,7 +9,7 @@ datamodel: description: This search looks for cloud compute instances being created with previously unseen image IDs. search: '| tstats count earliest(_time) as firstTime, latest(_time) as lastTime values(All_Changes.object_id) - as dest from datamodel=Change where All_Changes.action=created by All_Changes.Instance_Changes.image_id, + as dest from datamodel=Change.All_Changes where All_Changes.action=created by All_Changes.Instance_Changes.image_id, All_Changes.user | `drop_dm_object_name("All_Changes")` | `drop_dm_object_name("Instance_Changes")` | where image_id != "unknown" | lookup previously_seen_cloud_compute_images image_id as image_id OUTPUT firstTimeSeen, enough_data | eventstats max(enough_data) as enough_data diff --git a/detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml b/detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml index 1498019242..87efc54db6 100644 --- a/detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml +++ b/detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml @@ -8,7 +8,7 @@ datamodel: - Change description: Find EC2 instances being created with previously unseen instance types. search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime values(All_Changes.object_id) - as dest, count from datamodel=Change where All_Changes.action=created by All_Changes.Instance_Changes.instance_type, + as dest, count from datamodel=Change.All_Changes where All_Changes.action=created by All_Changes.Instance_Changes.instance_type, All_Changes.user | `drop_dm_object_name("All_Changes")` | `drop_dm_object_name("Instance_Changes")` | where instance_type != "unknown" | lookup previously_seen_cloud_compute_instance_types instance_type as instance_type OUTPUTNEW firstTimeSeen, enough_data | eventstats diff --git a/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml b/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml index da2a51b79e..5bf2246bf0 100644 --- a/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml +++ b/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml @@ -10,7 +10,7 @@ description: This search looks for cloud instances being modified by users who h not previously modified them. search: '| tstats `security_content_summariesonly` count earliest(_time) as firstTime, latest(_time) as lastTime values(All_Changes.object_id) as object_id values(All_Changes.command) - as command from datamodel=Change where All_Changes.action=modified All_Changes.change_type=EC2 + as command from datamodel=Change.All_Changes where All_Changes.action=modified All_Changes.change_type=EC2 All_Changes.status=success by All_Changes.user | `drop_dm_object_name("All_Changes")` | lookup previously_seen_cloud_instance_modifications_by_user user as user OUTPUTNEW firstTimeSeen, enough_data | eventstats max(enough_data) as enough_data | where diff --git a/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml b/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml index 3299a3f417..0cf7d9894d 100644 --- a/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml +++ b/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml @@ -9,7 +9,7 @@ datamodel: description: This search looks for cloud provisioning activities from previously unseen cities. Provisioning activities are defined broadly as any event that runs or creates something. -search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime from datamodel=Change +search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime from datamodel=Change.All_Changes where (All_Changes.action=started OR All_Changes.action=created) All_Changes.status=success by All_Changes.src, All_Changes.user, All_Changes.object, All_Changes.command | `drop_dm_object_name("All_Changes")` | iplocation src | where isnotnull(City) | diff --git a/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml b/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml index daeaf8d490..dbb77c2335 100644 --- a/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml +++ b/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml @@ -9,7 +9,7 @@ datamodel: description: This search looks for cloud provisioning activities from previously unseen countries. Provisioning activities are defined broadly as any event that runs or creates something. -search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime from datamodel=Change +search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime from datamodel=Change.All_Changes where (All_Changes.action=started OR All_Changes.action=created) All_Changes.status=success by All_Changes.src, All_Changes.user, All_Changes.object, All_Changes.command | `drop_dm_object_name("All_Changes")` | iplocation src | where isnotnull(Country) diff --git a/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml b/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml index 754efaf604..5c86c14cb0 100644 --- a/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml +++ b/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml @@ -10,7 +10,7 @@ description: This search looks for cloud provisioning activities from previously IP addresses. Provisioning activities are defined broadly as any event that runs or creates something. search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime, values(All_Changes.object_id) - as object_id from datamodel=Change where (All_Changes.action=started OR All_Changes.action=created) + as object_id from datamodel=Change.All_Changes where (All_Changes.action=started OR All_Changes.action=created) All_Changes.status=success by All_Changes.src, All_Changes.user, All_Changes.command | `drop_dm_object_name("All_Changes")` | lookup previously_seen_cloud_provisioning_activity_sources src as src OUTPUT firstTimeSeen, enough_data | eventstats max(enough_data) as enough_data diff --git a/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml b/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml index ac3797daba..48456c0769 100644 --- a/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml +++ b/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml @@ -9,7 +9,7 @@ datamodel: description: This search looks for cloud provisioning activities from previously unseen regions. Provisioning activities are defined broadly as any event that runs or creates something. -search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime from datamodel=Change +search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime from datamodel=Change.All_Changes where (All_Changes.action=started OR All_Changes.action=created) All_Changes.status=success by All_Changes.src, All_Changes.user, All_Changes.object, All_Changes.command | `drop_dm_object_name("All_Changes")` | iplocation src | where isnotnull(Region) diff --git a/detections/cloud/detect_aws_console_login_by_new_user.yml b/detections/cloud/detect_aws_console_login_by_new_user.yml index a9a758834d..b3f286b339 100644 --- a/detections/cloud/detect_aws_console_login_by_new_user.yml +++ b/detections/cloud/detect_aws_console_login_by_new_user.yml @@ -11,7 +11,7 @@ description: This search looks for AWS CloudTrail events wherein a console login file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour -search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication +search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication.Authentication where Authentication.signature=ConsoleLogin by Authentication.user | `drop_dm_object_name(Authentication)` | join user type=outer [ inputlookup previously_seen_users_console_logins | stats min(firstTime) as earliestseen by user] | eval userStatus=if(earliestseen >= relative_time(now(), diff --git a/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml b/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml index eee269a1eb..e1604415d7 100644 --- a/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml +++ b/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml @@ -11,7 +11,7 @@ description: This search looks for AWS CloudTrail events wherein a console login file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour -search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication +search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication.Authentication where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src | iplocation Authentication.src | `drop_dm_object_name(Authentication)` | table firstTime lastTime user City | join user type=outer [| inputlookup previously_seen_users_console_logins diff --git a/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml b/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml index 8c672eef83..f017005eef 100644 --- a/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml +++ b/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml @@ -11,7 +11,7 @@ description: This search looks for AWS CloudTrail events wherein a console login file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour -search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication +search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication.Authentication where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src | iplocation Authentication.src | `drop_dm_object_name(Authentication)` | table firstTime lastTime user Country | join user type=outer [| inputlookup previously_seen_users_console_logins diff --git a/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml b/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml index e9f51bd972..ef02104408 100644 --- a/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml +++ b/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml @@ -11,7 +11,7 @@ description: This search looks for AWS CloudTrail events wherein a console login file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour -search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication +search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication.Authentication where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src | iplocation Authentication.src | `drop_dm_object_name(Authentication)` | table firstTime lastTime user Region | join user type=outer [| inputlookup previously_seen_users_console_logins diff --git a/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml b/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml index 5b98774eff..c823c67b9c 100644 --- a/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml +++ b/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml @@ -5,7 +5,7 @@ date: '2020-11-09' author: David Dorsey, Splunk type: Anomaly datamodel: -- Change +- Change.All_Changes description: This search identifies endpoints that have caused a relatively high number of account lockouts in a short period. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) @@ -68,9 +68,8 @@ tags: - Splunk Cloud required_fields: - _time - - All_Changes.user - - nodename - - All_Changes.result - - All_Changes.dest + - Change.All_Changes.user + - Change.All_Changes.result + - Change.All_Changes.dest risk_score: 36 security_domain: access diff --git a/detections/endpoint/java_class_file_download_by_java_user_agent.yml b/detections/endpoint/java_class_file_download_by_java_user_agent.yml index 864c3d03fd..03c7bc0dbf 100644 --- a/detections/endpoint/java_class_file_download_by_java_user_agent.yml +++ b/detections/endpoint/java_class_file_download_by_java_user_agent.yml @@ -10,7 +10,7 @@ description: The following analytic identifies a Java user agent performing a GE request for a .class file from the remote site. This is potentially indicative of exploitation of the Java application and may be related to current event CVE-2021-44228 (Log4Shell). -search: '| tstats count from datamodel=Web where Web.http_user_agent="*Java*" Web.http_method="GET" +search: '| tstats count from datamodel=Web.Web where Web.http_user_agent="*Java*" Web.http_method="GET" Web.url="*.class*" by Web.http_user_agent Web.http_method, Web.url,Web.url_length Web.src, Web.dest | `drop_dm_object_name("Web")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `java_class_file_download_by_java_user_agent_filter`' diff --git a/detections/endpoint/potentially_malicious_code_on_commandline.yml b/detections/endpoint/potentially_malicious_code_on_commandline.yml index 0ca4d0c6fd..57c5634513 100644 --- a/detections/endpoint/potentially_malicious_code_on_commandline.yml +++ b/detections/endpoint/potentially_malicious_code_on_commandline.yml @@ -17,7 +17,7 @@ description: The following analytic uses a pretrained machine learning text clas found in normal usage of the commandline. The model will output a score where all values above zero are suspicious, anything greater than one particularly so. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel="Endpoint.Processes" by Processes.parent_process_name + as lastTime from datamodel=Endpoint.Processes by Processes.parent_process_name Processes.process_name Processes.process Processes.user Processes.dest | `drop_dm_object_name(Processes)` | where len(process) > 200 | `potentially_malicious_code_on_cmdline_tokenize_score` | apply unusual_commandline_detection | eval score=''predicted(unusual_cmdline_logits)'', diff --git a/detections/endpoint/short_lived_windows_accounts.yml b/detections/endpoint/short_lived_windows_accounts.yml index 41eaafaaab..839c7fb59b 100644 --- a/detections/endpoint/short_lived_windows_accounts.yml +++ b/detections/endpoint/short_lived_windows_accounts.yml @@ -9,7 +9,7 @@ datamodel: description: This search detects accounts that were created and deleted in a short time period. search: '| tstats `security_content_summariesonly` values(All_Changes.result_id) as - result_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Change + result_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Change.All_Changes where All_Changes.result_id=4720 OR All_Changes.result_id=4726 by _time span=4h All_Changes.user All_Changes.dest | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name("All_Changes")` | search result_id = 4720 result_id=4726 diff --git a/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml b/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml index ae495cfec9..7b385820f2 100644 --- a/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml +++ b/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml @@ -13,7 +13,7 @@ description: Malicious actors often abuse legitimate Dynamic DNS services to hos analytic and investigative processes. This search will look for DNS queries made from within your infrastructure to suspicious dynamic domains. search: '| tstats `security_content_summariesonly` count values(DNS.answer) as answer - min(_time) as firstTime from datamodel=Network_Resolution by DNS.query host | `drop_dm_object_name("DNS")` + min(_time) as firstTime from datamodel=Network_Resolution.DNS by DNS.query host | `drop_dm_object_name("DNS")` | `security_content_ctime(firstTime)` | `dynamic_dns_providers` | `detect_hosts_connecting_to_dynamic_domain_providers_filter`' how_to_implement: 'First, you''ll need to ingest data from your DNS operations. This can be done by ingesting logs from your server or data, collected passively by Splunk diff --git a/detections/network/dns_query_length_with_high_standard_deviation.yml b/detections/network/dns_query_length_with_high_standard_deviation.yml index 30c1805342..2474317aac 100644 --- a/detections/network/dns_query_length_with_high_standard_deviation.yml +++ b/detections/network/dns_query_length_with_high_standard_deviation.yml @@ -9,7 +9,7 @@ datamodel: description: This search allows you to identify DNS requests and compute the standard deviation on the length of the names being resolved, then filter on two times the standard deviation to show you those queries that are unusually large for your environment. -search: '| tstats `security_content_summariesonly` count from datamodel=Network_Resolution +search: '| tstats `security_content_summariesonly` count from datamodel=Network_Resolution.DNS where NOT DNS.message_type IN("Pointer","PTR") by DNS.query | `drop_dm_object_name("DNS")` | eval tlds=split(query,".") | eval tld=mvindex(tlds,-1) | eval tld_len=len(tld) | search tld_len<=24 | eval query_length = len(query) | table query query_length