network:dns
DNS query logs (resolver / passive DNS)
- Host type
- Network devices and network sensors
- Tier, as a whole
- Minimum
- Techniques
- 2
- Rules listed
- 47
- Events
- 0
Why this tier
CISA/ASD priority source; OMB M-26-14 A2 (Network source and destination; our analysis); OMB M-26-14 A7 (Indicators of compromise; our analysis)
Standards and guidance naming this source
| Requirement | Relation | Basis |
|---|---|---|
| OMB M-26-14: Network source and destination | Supports an activity | our analysis |
| OMB M-26-14: Indicators of compromise | Supports an activity | our analysis: domain and resolver indicators |
| ASD ACSC / CISA et al.: Priority enterprise log sources | priority_source | quoted: DNS services used by organisational users |
Techniques
Rules
Sigma 11
- Axios NPM Compromise Malicious C2 Domain DNS Query by Swachchhanda Shrawan Poudel (Nextron Systems)
- Cobalt Strike DNS Beaconing by Florian Roth (Nextron Systems)
- DNS Query To Katz Stealer Domains - Network by Swachchhanda Shrawan Poudel (Nextron Systems)
- DNS Query to External Service Interaction Domains by Florian Roth (Nextron Systems), Matt Kelly (list of domains)
- DNS TXT Answer with Possible Execution Strings by Markus Neis
- Low Reputation Effective Top-Level Domain (eTLD) by Norbert Jaśniewicz (AlphaSOC)
- Monero Crypto Coin Mining Pool Lookup by Florian Roth (Nextron Systems)
- Potential Operation Triangulation C2 Beaconing Activity - DNS by Florian Roth (Nextron Systems)
- Suspicious DNS Query with B64 Encoded String by Florian Roth (Nextron Systems)
- Telegram Bot API Request by Florian Roth (Nextron Systems)
- Wannacry Killswitch Domain by Mike Wade
Microsoft Sentinel 35
- DNS events related to ToR proxies
- DNS events related to ToR proxies (ASIM DNS Schema)
- DNS events related to mining pools
- DNS events related to mining pools (ASIM DNS Schema)
- Detect DNS queries reporting multiple errors from different clients - Anomaly Based (ASIM DNS Solution)
- Detect DNS queries reporting multiple errors from different clients - Static threshold based (ASIM DNS Solution)
- Detect excessive NXDOMAIN DNS queries - Anomaly based (ASIM DNS Solution)
- Detect excessive NXDOMAIN DNS queries - Static threshold based (ASIM DNS Solution)
- Europium - Hash and IP IOCs - September 2022
- Excessive NXDOMAIN DNS Queries (ASIM DNS Schema)
- GreyNoise TI Map IP Entity to DnsEvents
- Known Forest Blizzard group domains - July 2019
- Log4j vulnerability exploit aka Log4Shell IP IOC
- Lumen TI domain in DnsEvents
- Mercury - Domain, Hash and IP IOCs - August 2022
- NRT DNS events related to mining pools
- Ngrok Reverse Proxy on Network (ASIM DNS Solution)
- PRODAFT USTA - TI map Domain to DnsEvents
- Potential DGA detected
- Potential DGA detected (ASIM DNS Schema)
- Potential DGA(Domain Generation Algorithm) detected via Repetitive Failures - Anomaly based (ASIM DNS Solution)
- Potential DGA(Domain Generation Algorithm) detected via Repetitive Failures - Static threshold based (ASIM DNS Solution)
- Rare client observed with high reverse DNS lookup count
- Rare client observed with high reverse DNS lookup count - Anomaly based (ASIM DNS Solution)
- Rare client observed with high reverse DNS lookup count - Static threshold based (ASIM DNS Solution)
- TI Map Domain entity to Dns Events (ASIM DNS Schema)
- TI Map Domain entity to DnsEvents
- TI Map IP Entity to DnsEvents
- TI Map IP Entity to DnsEvents
- TI Map IP entity to DNS Events (ASIM DNS schema)
- TI map Domain entity to Dns Events (ASIM DNS Schema)
- TI map Domain entity to DnsEvents
- TI map IP entity to DNS Events (ASIM DNS schema)
- Threat Connect TI map Domain entity to DnsEvents
- [Deprecated] - Zinc Actor IOCs domains hashes IPs and useragent - October 2022
Events
No event-level rows: this source is tiered as a whole.