rules/network/net_high_dns_bytes_out.yml

title: High DNS Bytes Out
id: 0f6c1bf5-70a5-4963-aef9-aab1eefb50bd
status: experimental
description: High DNS queries bytes amount from host per short period of time
author: Daniil Yugoslavskiy, oscd.community
date: 2019/10/24
modified: 2021/09/21
tags:
    - attack.exfiltration
    - attack.t1048.003
logsource:
    category: dns
detection:
    selection:
        query: '*'
    timeframe: 1m
    condition: selection | sum(question_length) by src_ip > 300000
falsepositives:
    - Legitimate high DNS bytes out rate to domain name which should be added to whitelist
level: medium
Rule fixes 2020-02-20 23:00:16 +01:00			`title: High DNS Bytes Out`
$frack113$ split global net_high_dns_bytes_out.yml 2021-09-21 19:53:25 +02:00			`id: 0f6c1bf5-70a5-4963-aef9-aab1eefb50bd`
add tieto dns exfiltration rules 2019-10-25 04:30:55 +02:00			`status: experimental`
Second round 2020-09-15 07:02:30 -06:00			`description: High DNS queries bytes amount from host per short period of time`
add tieto dns exfiltration rules 2019-10-25 04:30:55 +02:00			`author: Daniil Yugoslavskiy, oscd.community`
			`date: 2019/10/24`
$frack113$ split global net_high_dns_bytes_out.yml 2021-09-21 19:53:25 +02:00			`modified: 2021/09/21`
add tieto dns exfiltration rules 2019-10-25 04:30:55 +02:00			`tags:`
			`- attack.exfiltration`
att&ck tags review: windows/process_creation part 1, network 2020-08-27 20:43:47 +03:00			`- attack.t1048.003`
add tieto dns exfiltration rules 2019-10-25 04:30:55 +02:00			`logsource:`
			`category: dns`
			`detection:`
			`selection:`
			`query: '*'`
			`timeframe: 1m`
			`condition: selection \| sum(question_length) by src_ip > 300000`
$frack113$ split global net_high_dns_bytes_out.yml 2021-09-21 19:53:25 +02:00			`falsepositives:`
			`- Legitimate high DNS bytes out rate to domain name which should be added to whitelist`
			`level: medium`