Nasreddine Bencherchali
95793d73bd
chore: update workflows and add quality of life updates and automation to the repository --------- Co-authored-by: phantinuss <79651203+phantinuss@users.noreply.github.com>
75 lines
2.6 KiB
YAML
75 lines
2.6 KiB
YAML
title: Suspicious DNS Z Flag Bit Set
|
|
id: ede05abc-2c9e-4624-9944-9ff17fdc0bf5
|
|
status: test
|
|
description: |
|
|
The DNS Z flag is bit within the DNS protocol header that is, per the IETF design, meant to be used reserved (unused).
|
|
Although recently it has been used in DNSSec, the value being set to anything other than 0 should be rare.
|
|
Otherwise if it is set to non 0 and DNSSec is being used, then excluding the legitimate domains is low effort and high reward.
|
|
Determine if multiple of these files were accessed in a short period of time to further enhance the possibility of seeing if this was a one off or the possibility of larger sensitive file gathering.
|
|
This Sigma query is designed to accompany the Corelight Threat Hunting Guide, which can be found here: https://www3.corelight.com/corelights-introductory-guide-to-threat-hunting-with-zeek-bro-logs'
|
|
references:
|
|
- https://twitter.com/neu5ron/status/1346245602502443009
|
|
- https://tdm.socprime.com/tdm/info/eLbyj4JjI15v#sigma
|
|
- https://tools.ietf.org/html/rfc2929#section-2.1
|
|
- https://www.netresec.com/?page=Blog&month=2021-01&post=Finding-Targeted-SUNBURST-Victims-with-pDNS
|
|
author: '@neu5ron, SOC Prime Team, Corelight'
|
|
date: 2021/05/04
|
|
modified: 2022/11/29
|
|
tags:
|
|
- attack.t1095
|
|
- attack.t1571
|
|
- attack.command_and_control
|
|
logsource:
|
|
product: zeek
|
|
service: dns
|
|
detection:
|
|
z_flag_unset:
|
|
Z: 0
|
|
most_probable_valid_domain:
|
|
query|contains: '.'
|
|
exclude_tlds:
|
|
query|endswith:
|
|
- '.arpa'
|
|
- '.local'
|
|
- '.ultradns.net'
|
|
- '.twtrdns.net'
|
|
- '.azuredns-prd.info'
|
|
- '.azure-dns.com'
|
|
- '.azuredns-ff.info'
|
|
- '.azuredns-ff.org'
|
|
- '.azuregov-dns.org'
|
|
exclude_query_types:
|
|
qtype_name:
|
|
- 'ns'
|
|
- 'mx'
|
|
exclude_responses:
|
|
answers|endswith: '\\x00'
|
|
exclude_netbios:
|
|
id.resp_p:
|
|
- 137
|
|
- 138
|
|
- 139
|
|
condition: not z_flag_unset and most_probable_valid_domain and not (exclude_tlds or exclude_query_types or exclude_responses or exclude_netbios)
|
|
fields:
|
|
- ts
|
|
- id.orig_h
|
|
- id.orig_p
|
|
- id.resp_h
|
|
- id.resp_p
|
|
- proto
|
|
- qtype_name
|
|
- qtype
|
|
- query
|
|
- answers
|
|
- rcode
|
|
- rcode_name
|
|
- trans_id
|
|
- qtype
|
|
- ttl
|
|
- AA
|
|
- uid
|
|
falsepositives:
|
|
- 'Internal or legitimate external domains using DNSSec. Verify if these are legitimate DNSSec domains and then exclude them.'
|
|
- 'If you work in a Public Sector then it may be good to exclude things like endswith ".edu", ".gov" and or ".mil"'
|
|
level: medium
|