Detection Of DNS Tunnels

Description

This search is used to detect DNS tunneling, by calculating the sum of the length of DNS queries and DNS answers. The search also filters out potential false positives by filtering out queries made to internal systems and the queries originating from internal DNS, Web, and Email servers. Endpoints using DNS as a method of transmission for data exfiltration, command and control, or evasion of security controls can often be detected by noting an unusually large volume of DNS traffic.

Content Mapping

This content is not mapped to any local saved search. Add mapping


Use Case

Advanced Threat Detection

Category

Command and Control

Alert Volume

This search is used to detect DNS tunneling, by calculating the sum of the length of DNS queries and DNS answers. The search also filters out potential false positives by filtering out queries made to internal systems and the queries originating from internal DNS, Web, and Email servers. Endpoints using DNS as a method of transmission for data exfiltration, command and control, or evasion of security controls can often be detected by noting an unusually large volume of DNS traffic.

SPL Difficulty

None

Journey

Stage 3

MITRE ATT&CK Techniques

Application Layer Protocol

DNS

MITRE Threat Groups

APT18
APT39
APT41
Cobalt Group
FIN7
Ke3chang
OilRig
Tropic Trooper

Kill Chain Phases

Command and Control
Actions On Objectives

Data Sources

DNS

   Help

Detection Of DNS Tunnels Help

To successfully implement this search, we must ensure that DNS data is being ingested and mapped to the appropriate fields in the NetworkResolution data model. Fields like srccategory are automatically provided by the Assets and Identity Framework shipped with Splunk Enterprise Security. You will need to ensure you are using the Assets and Identity Framework and populating the src_category field. You will also need to enable the cim_corporate_web_domain_search() macro which will essentially filter out the DNS queries made to the corporate web domains to reduce alert fatigue.

   Search

Open in Search