Techniques
Sample rules
DNS Query Length With High Standard Deviation
- source: splunk
- technicques:
- T1048.003
- T1048
Description
This search allows you to identify DNS requests and compute the standard deviation on the length of the names being resolved, then filter on two times the standard deviation to show you those queries that are unusually large for your environment.
Detection logic
| tstats `security_content_summariesonly` count from datamodel=Network_Resolution where NOT DNS.record_type IN("Pointer","PTR") by DNS.query host
| `drop_dm_object_name("DNS")`
| eval tlds=split(query,".")
| eval tld=mvindex(tlds,-1)
| eval tld_len=len(tld)
| search tld_len<=24
| eval query_length = len(query)
| table host query query_length record_type count
| eventstats stdev(query_length) AS stdev avg(query_length) AS avg p50(query_length) AS p50
| where query_length>(avg+stdev*2)
| eval z_score=(query_length-avg)/stdev
| `dns_query_length_with_high_standard_deviation_filter`