DNS Rebinding — Rapid TTL Change for Same Domain
07 DNS Rebinding Rapid TTL
Query
ASimDnsActivityLogs
| where TimeGenerated > ago(30m)
| where EventResult =~ "Success"
| where DnsAnswerCount > 0
| summarize
QueryCount = count(),
FirstSeen = min(TimeGenerated),
LastSeen = max(TimeGenerated),
SrcHostname = any(SrcHostname)
by SrcIpAddr, DnsQuery
| where QueryCount >= 10
| extend SpanSeconds = datetime_diff('second', LastSeen, FirstSeen)
| where SpanSeconds > 0
| extend ReResolutionRate = round(todouble(QueryCount) / todouble(SpanSeconds) * 60.0, 2)
| where ReResolutionRate >= 4
| project
SrcIpAddr,
SrcHostname,
DnsQuery,
QueryCount,
ReResolutionRate,
SpanSeconds,
FirstSeen,
LastSeenExplanation
This query is designed to detect potential DNS rebinding attacks by monitoring DNS activity logs. Here's a simplified explanation of what it does:
-
Purpose: The query aims to identify domains that quickly change their resolved IP addresses multiple times within a short period. This behavior is indicative of DNS rebinding attacks, where an attacker manipulates DNS responses to bypass security policies and access internal network services.
-
Data Source: It uses data from Windows DNS logs, specifically focusing on successful DNS queries.
-
Detection Logic:
- It looks at DNS queries from the last 30 minutes.
- It counts how many times each domain (DNS query) is resolved by a specific source IP address.
- It calculates the time span between the first and last resolution of each domain.
- It computes the rate of re-resolution (how often the domain is resolved per minute).
- It flags domains that have been resolved at least 10 times with a re-resolution rate of 4 or more per minute.
-
Output: The query outputs details such as the source IP address, source hostname, domain queried, number of queries, re-resolution rate, and the time span of these queries.
-
Alerting: If the conditions are met, it generates an alert indicating a potential DNS rebinding attack, providing details about the source and the domain involved.
-
Severity and Techniques: The severity is marked as medium, and it relates to tactics like lateral movement and defense evasion, with techniques T1557 (Man-in-the-Middle) and T1090 (Connection Proxy).
-
Tags and References: It includes tags like DNS Rebinding and Same-Origin Policy Bypass, and references to further reading on DNS rebinding attacks.
Overall, this query helps security teams identify suspicious DNS activity that could indicate an attempt to exploit DNS rebinding vulnerabilities.
Details
David Alonso
Released: July 28, 2026
Tables
Keywords
Operators
Severity
MediumTactics
Frequency: 30m
Period: 30m