mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
divious1
47 lines
2.2 KiB
YAML
47 lines
2.2 KiB
YAML
category:
|
|
- Abuse
|
|
channel: ESCU
|
|
creation_date: '2016-08-24'
|
|
description: DNS poses a serious threat as a Denial of Service (DOS) amplifier, if
|
|
it responds to `ANY` queries. This Analytic Story can help you detect attackers
|
|
who may be abusing your company's DNS infrastructure to launch amplification attacks,
|
|
causing Denial of Service to other victims.
|
|
detections:
|
|
- detection_id: 8fa891f7-a533-4b3c-af85-5aa2e7c1f1eb
|
|
name: Large Volume of DNS ANY Queries
|
|
type: splunk
|
|
id: e8afd39e-3294-11e6-b39d-a45e60c6700
|
|
maintainers:
|
|
- company: Splunk
|
|
email: bpatel@splunk.com
|
|
name: Bhavin Patel
|
|
modification_date: '2016-09-13'
|
|
name: DNS Amplification Attacks
|
|
narrative: 'The Domain Name System (DNS) is the protocol used to map domain names
|
|
to IP addresses. It has been proven to work very well for its intended function.
|
|
However if DNS is misconfigured, servers can be abused by attackers to levy amplification
|
|
or redirection attacks against victims. Because DNS responses to `ANY` queries are
|
|
so much larger than the queries themselves--and can be made with a UDP packet, which
|
|
does not require a handshake--attackers can spoof the source address of the packet
|
|
and cause much more data to be sent to the victim than if they sent the traffic
|
|
themselves. The `ANY` requests are will be larger than normal DNS server requests,
|
|
due to the fact that the server provides significant details, such as MX records
|
|
and associated IP addresses. A large volume of this traffic can result in a DOS
|
|
on the victim''s machine. This misconfiguration leads to two possible victims, the
|
|
first being the DNS servers participating in an attack and the other being the hosts
|
|
that are the targets of the DOS attack.\
|
|
|
|
The search in this story can help you to detect if attackers are abusing your company''s
|
|
DNS infrastructure to launch DNS amplification attacks causing Denial of Service
|
|
to other victims.'
|
|
original_authors:
|
|
- company: Splunk
|
|
email: bpatel@splunk.com
|
|
name: Bhavin Patel
|
|
references:
|
|
- https://www.us-cert.gov/ncas/alerts/TA13-088A
|
|
- https://www.imperva.com/learn/application-security/dns-amplification/
|
|
spec_version: 2
|
|
usecase: Security Monitoring
|
|
version: '1.0'
|