mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Patrick Bareiss
52 lines
2.6 KiB
YAML
52 lines
2.6 KiB
YAML
name: DNS record changed
|
|
id: 44d3a43e-dcd5-49f7-8356-5209bb369065
|
|
version: 2
|
|
date: '2020-01-16'
|
|
description: The search takes the DNS records and their answers results of the discovered_dns_records
|
|
lookup and finds if any records have changed by searching DNS response from the
|
|
Network_Resolution datamodel across the last day.
|
|
how_to_implement: "To successfully implement this search you will need to ensure that\
|
|
\ DNS data is populating the `Network_Resolution` data model. It also requires that\
|
|
\ the `discover_dns_record` lookup table be populated by the included support search\
|
|
\ \"Discover DNS record\". \\\n **Splunk>Phantom Playbook Integration**\\\nIf Splunk>Phantom\
|
|
\ is also configured in your environment, a Playbook called \"DNS Hijack Enrichment\"\
|
|
\ can be configured to run when any results are found by this detection search.\
|
|
\ The playbook takes in the DNS record changed and uses Geoip, whois, Censys and\
|
|
\ PassiveTotal to detect if DNS issuers changed. To use this integration, install\
|
|
\ the Phantom App for Splunk `https://splunkbase.splunk.com/app/3411/`, add the\
|
|
\ correct hostname to the \"Phantom Instance\" field in the Adaptive Response Actions\
|
|
\ when configuring this detection search, and set the corresponding Playbook to\
|
|
\ active. \\\n(Playbook Link:`https://my.phantom.us/4.2/playbook/dns-hijack-enrichment/`).\\\
|
|
\n"
|
|
type: ESCU
|
|
author: Jose Hernandez, Splunk
|
|
search: '| inputlookup discovered_dns_records.csv | rename answer as discovered_answer
|
|
| join domain[|tstats `security_content_summariesonly` count values(DNS.record_type)
|
|
as type, values(DNS.answer) as current_answer values(DNS.src) as src from datamodel=Network_Resolution
|
|
where DNS.message_type=RESPONSE DNS.answer!="unknown" DNS.answer!="" by DNS.query
|
|
| rename DNS.query as query | where query!="unknown" | rex field=query "(?<domain>\w+\.\w+?)(?:$|/)"]
|
|
| makemv delim=" " answer | makemv delim=" " type | sort -count | table count,src,domain,type,query,current_answer,discovered_answer
|
|
| makemv current_answer | mvexpand current_answer | makemv discovered_answer |
|
|
eval n=mvfind(discovered_answer, current_answer) | where isnull(n) | `dns_record_changed_filter`'
|
|
known_false_positives: Legitimate DNS changes can be detected in this search. Investigate,
|
|
verify and update the list of provided current answers for the domains in question
|
|
as appropriate.
|
|
tags:
|
|
analytics_story:
|
|
- DNS Hijacking
|
|
kill_chain_phases:
|
|
- Command and Control
|
|
cis20:
|
|
- CIS 1
|
|
- CIS 3
|
|
- CIS 8
|
|
- CIS 12
|
|
nist:
|
|
- ID.AM
|
|
- PR.DS
|
|
- PR.IP
|
|
- DE.AE
|
|
- DE.CM
|
|
security_domain: network
|
|
asset_type: Endpoint
|