Clients Connecting To Multiple DNS Servers

Description

This search allows you to identify the endpoints that have connected to more than five DNS servers and made DNS Queries over the time frame of the search.

Content Mapping

This content is not mapped to any local saved search. Add mapping


Use Case

Advanced Threat Detection

Category

Command and Control

Alert Volume

This search allows you to identify the endpoints that have connected to more than five DNS servers and made DNS Queries over the time frame of the search.

SPL Difficulty

None

Journey

Stage 3

MITRE ATT&CK Tactics

Exfiltration

MITRE ATT&CK Techniques

Exfiltration Over Alternative Protocol

Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol

MITRE Threat Groups

APT32
APT33
FIN6
FIN8
Lazarus Group
OilRig
Thrip
Wizard Spider

Kill Chain Phases

Command and Control

Data Sources

DNS

   Help

Clients Connecting To Multiple DNS Servers Help

This search requires that DNS data is being ingested and populating the Network_Resolution data model. This data can come from DNS logs or from solutions that parse network traffic for this data, such as Splunk Stream or Bro.\ This search produces fields (dest_count) that are not yet supported by ES Incident Review and therefore cannot be viewed when a notable event is raised. These fields contribute additional context to the notable. To see the additional metadata, add the following fields, if not already present, to Incident Review - Event Attributes (Configure > Incident Management > Incident Review Settings > Add New Entry):\n1. Label: Distinct DNS Connections, Field: dest_count\ Detailed documentation on how to create a new field within Incident Review may be found here: https://docs.splunk.com/Documentation/ES/5.3.0/Admin/Customizenotables#Add_a_field_to_the_notable_event_details

   Search

Open in Search