Detection: DNS Exfiltration Using Nslookup App

Description

This search is to detect potential DNS exfiltration using nslookup application. This technique are seen in couple of malware and APT group to exfiltrated collected data in a infected machine or infected network. This detection is looking for unique use of nslookup where it tries to use specific record type, TXT, A, AAAA, that are commonly used by attacker and also the retry parameter which is designed to query C2 DNS multiple tries.

Annotations

No annotations available.

Implementation

To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the Endpoint_Processess datamodel.

Known False Positives

It is possible for some legitimate administrative utilities to use similar process parameters. Filter as needed.

Associated Analytic Story

• Suspicious DNS Traffic

• Dynamic DNS

• Data Exfiltration

• Command And Control

Risk Based Analytics (RBA)

References

• https://www.mandiant.com/resources/fin7-spear-phishing-campaign-targets-personnel-involved-sec-filings

• https://www.varonis.com/blog/dns-tunneling

• https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/

Version: 4