Techniques
Sample rules
Detect DNS Data Exfiltration using pretrained model in DSDL
- source: splunk
- technicques:
- T1048.003
Description
The following analytic identifies potential DNS data exfiltration using a pre-trained deep learning model. It leverages DNS request data from the Network Resolution datamodel and computes features from past events between the same source and domain. The model generates a probability score (pred_is_exfiltration_proba) indicating the likelihood of data exfiltration. This activity is significant as DNS tunneling can be used by attackers to covertly exfiltrate sensitive data. If confirmed malicious, this could lead to unauthorized data access and potential data breaches, compromising the organization’s security posture.
Detection logic
| tstats `security_content_summariesonly` count from datamodel=Network_Resolution by DNS.src _time DNS.query
| `drop_dm_object_name("DNS")`
| sort - _time,src, query
| streamstats count as rank by src query
| where rank < 10
| table src,query,rank,_time
| apply detect_dns_data_exfiltration_using_pretrained_model_in_dsdl
| table src,_time,query,rank,pred_is_dns_data_exfiltration_proba,pred_is_dns_data_exfiltration
| where rank == 1
| rename pred_is_dns_data_exfiltration_proba as is_exfiltration_score
| rename pred_is_dns_data_exfiltration as is_exfiltration
| where is_exfiltration_score > 0.5
| `security_content_ctime(_time)`
| table src, _time,query,is_exfiltration_score,is_exfiltration
| `detect_dns_data_exfiltration_using_pretrained_model_in_dsdl_filter`