splunk-security_content/docs/_stories/suspicious_dns_traffic.md

title, last_modified_at, toc, tags

title	last_modified_at	toc	tags
Suspicious DNS Traffic	2017-09-18	true	Splunk Enterprise Splunk Enterprise Security Splunk Cloud Endpoint Network_Resolution

Try in Splunk Security Cloud{: .btn .btn--success}

Description

Attackers often attempt to hide within or otherwise abuse the domain name system (DNS). You can thwart attempts to manipulate this omnipresent protocol by monitoring for these types of abuses.

• Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
• Datamodel: Endpoint, Network_Resolution
• Last Updated: 2017-09-18
• Author: Rico Valdez, Splunk
• ID: 3c3835c0-255d-4f9e-ab84-e29ec9ec9b56

Narrative

Although DNS is one of the fundamental underlying protocols that make the Internet work, it is often ignored (perhaps because of its complexity and effectiveness). However, attackers have discovered ways to abuse the protocol to meet their objectives. One potential abuse involves manipulating DNS to hijack traffic and redirect it to an IP address under the attacker's control. This could inadvertently send users intending to visit google.com, for example, to an unrelated malicious website. Another technique involves using the DNS protocol for command-and-control activities with the attacker's malicious code or to covertly exfiltrate data. The searches within this Analytic Story look for these types of abuses.

Detections

Name	Technique	Type
DNS Exfiltration Using Nslookup App	Exfiltration Over Alternative Protocol, DNS, Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol, Non-Application Layer Protocol, Exfiltration Over C2 Channel, Drive-by Compromise, Transfer Data to Cloud Account, Local Email Collection, Email Collection, Email Forwarding Rule, Web Protocols	TTP
DNS Query Length Outliers - MLTK	DNS	Anomaly
DNS Query Length With High Standard Deviation	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	Anomaly
Detect hosts connecting to dynamic domain providers	Drive-by Compromise	TTP
Excessive DNS Failures	DNS	Anomaly
Excessive Usage of NSLOOKUP App	Exfiltration Over Alternative Protocol	Anomaly

Reference

• http://blogs.splunk.com/2015/10/01/random-words-on-entropy-and-dns/
• http://www.darkreading.com/analytics/security-monitoring/got-malware-three-signs-revealed-in-dns-traffic/d/d-id/1139680
• https://live.paloaltonetworks.com/t5/Threat-Vulnerability-Articles/What-are-suspicious-DNS-queries/ta-p/71454

source | version: 1