Detection: DNS Query Length With High Standard Deviation

Updated Date: 2024-05-15 ID: 1a67f15a-f4ff-4170-84e9-08cf6f75d6f5 Author: Bhavin Patel, Splunk Type: Anomaly Product: Splunk Enterprise Security

Description

The following analytic identifies DNS queries with unusually large lengths by computing the standard deviation of query lengths and filtering those exceeding twice the standard deviation. It leverages DNS query data from the Network_Resolution data model, focusing on the length of the domain names being resolved. This activity is significant as unusually long DNS queries can indicate data exfiltration or command-and-control communication attempts. If confirmed malicious, this activity could allow attackers to stealthily transfer data or maintain persistent communication channels within the network.

 1
 2| tstats `security_content_summariesonly` count from datamodel=Network_Resolution where NOT DNS.record_type IN("Pointer","PTR") by DNS.query host
 3| `drop_dm_object_name("DNS")` 
 4| eval tlds=split(query,".") 
 5| eval tld=mvindex(tlds,-1) 
 6| eval tld_len=len(tld) 
 7| search tld_len<=24 
 8| eval query_length = len(query) 
 9| table host query query_length record_type count 
10| eventstats stdev(query_length) AS stdev avg(query_length) AS avg p50(query_length) AS p50
11| where query_length>(avg+stdev*2) 
12| eval z_score=(query_length-avg)/stdev 
13| `dns_query_length_with_high_standard_deviation_filter`

Data Source

Name Platform Sourcetype Source Supported App
Sysmon EventID 22 Windows icon Windows 'xmlwineventlog' 'XmlWinEventLog:Microsoft-Windows-Sysmon/Operational' N/A

Macros Used

Name Value
security_content_summariesonly summariesonly=summariesonly_config allow_old_summaries=oldsummaries_config fillnull_value=fillnull_config``
dns_query_length_with_high_standard_deviation_filter search *
dns_query_length_with_high_standard_deviation_filter is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Annotations

- MITRE ATT&CK
+ Kill Chain Phases
+ NIST
+ CIS
- Threat Actors
ID Technique Tactic
T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol Exfiltration
T1048 Exfiltration Over Alternative Protocol Exfiltration
KillChainPhase.ACTIONS_ON_OBJECTIVES
NistCategory.DE_AE
Cis18Value.CIS_13
APT32
APT33
FIN6
FIN8
Lazarus Group
OilRig
Thrip
Wizard Spider
TeamTNT

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Setting Value
Disabled true
Cron Schedule 0 * * * *
Earliest Time -70m@m
Latest Time -10m@m
Schedule Window auto
Creates Risk Event True
This configuration file applies to all detections of type anomaly. These detections will use Risk Based Alerting.

Implementation

To successfully implement this search, you will need to ensure that DNS data is populating the Network_Resolution data model.

Known False Positives

It's possible there can be long domain names that are legitimate.

Associated Analytic Story

Risk Based Analytics (RBA)

Risk Message Risk Score Impact Confidence
A dns query $query$ with 2 time standard deviation of name len of the dns query in host $host$ 56 70 80
The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.

Detection Testing

Test Type Status Dataset Source Sourcetype
Validation ✅ Passing N/A N/A N/A
Unit ✅ Passing Dataset XmlWinEventLog:Microsoft-Windows-Sysmon/Operational xmlwineventlog
Integration ✅ Passing Dataset XmlWinEventLog:Microsoft-Windows-Sysmon/Operational xmlwineventlog

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub | Version: 6