security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Changed title and description

Browse Source
This commit is contained in:
Florian Roth
2019-04-21 08:54:56 +02:00
committed by GitHub
parent 0713360443
commit a85acdfd02
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/network/net_dns_c2_detection.yml
+2 -2
View File
@@ -1,6 +1,6 @@
title: DNS C2 Detection
title: Possible DNS Tunneling
status: experimental
description: Normally, there exists a limited amount of different dns queries for a single domain. If a huge number of dns queries were performed for a single domain, this can be an indicator that DNS is used for transferring data.
description: Normally, DNS logs contain a limited amount of different dns queries for a single domain. This rule detects a high amount of queries for a single domain, which can be an indicator that DNS is used to transfer data.
references:
- https://zeltser.com/c2-dns-tunneling/
- https://patrick-bareiss.com/detect-c2-traffic-over-dns-using-sigma/