admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Added detection testing service results inDetect hosts connecting to dynamic domain providers

Browse Source
This commit is contained in:
root
2021-01-14 15:15:59 +00:00
parent 50c3e8ead2
commit b751d5ddb8
1 changed files with 5 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml
+5 -3
View File
@@ -36,9 +36,8 @@ how_to_implement: 'First, you''ll need to ingest data from your DNS operations.
type: ESCU
author: Bhavin Patel, Splunk
search: '| tstats `security_content_summariesonly` count values(DNS.answer) as answer
min(_time) as firstTime from datamodel=Network_Resolution by DNS.query host
| `drop_dm_object_name("DNS")` | `security_content_ctime(firstTime)` | `dynamic_dns_providers`
| `detect_hosts_connecting_to_dynamic_domain_providers_filter`'
min(_time) as firstTime from datamodel=Network_Resolution by DNS.query host | `drop_dm_object_name("DNS")`
| `security_content_ctime(firstTime)` | `dynamic_dns_providers` | `detect_hosts_connecting_to_dynamic_domain_providers_filter`'
known_false_positives: Some users and applications may leverage Dynamic DNS to reach
out to some domains on the Internet since dynamic DNS by itself is not malicious,
however this activity must be verified.
@@ -66,3 +65,6 @@ tags:
- DE.CM
security_domain: network
asset_type: Endpoint
automated_detection_testing: passed
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1189/dyn_dns_site/windows-sysmon.log