From b751d5ddb86d2f9b7332b3bdde6fc5783eefb8a4 Mon Sep 17 00:00:00 2001 From: root Date: Thu, 14 Jan 2021 15:15:59 +0000 Subject: [PATCH] Added detection testing service results inDetect hosts connecting to dynamic domain providers --- ...etect_hosts_connecting_to_dynamic_domain_providers.yml | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml b/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml index ebf374f6e1..4da49a35fe 100644 --- a/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml +++ b/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml @@ -36,9 +36,8 @@ how_to_implement: 'First, you''ll need to ingest data from your DNS operations. type: ESCU author: Bhavin Patel, Splunk search: '| tstats `security_content_summariesonly` count values(DNS.answer) as answer - min(_time) as firstTime from datamodel=Network_Resolution by DNS.query host - | `drop_dm_object_name("DNS")` | `security_content_ctime(firstTime)` | `dynamic_dns_providers` - | `detect_hosts_connecting_to_dynamic_domain_providers_filter`' + min(_time) as firstTime from datamodel=Network_Resolution by DNS.query host | `drop_dm_object_name("DNS")` + | `security_content_ctime(firstTime)` | `dynamic_dns_providers` | `detect_hosts_connecting_to_dynamic_domain_providers_filter`' known_false_positives: Some users and applications may leverage Dynamic DNS to reach out to some domains on the Internet since dynamic DNS by itself is not malicious, however this activity must be verified. @@ -66,3 +65,6 @@ tags: - DE.CM security_domain: network asset_type: Endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1189/dyn_dns_site/windows-sysmon.log