KQL Search

This query is designed to detect potential security threats related to the misuse of the Web Proxy Auto-Discovery (WPAD) protocol. Here's a simplified breakdown:

• Purpose: The query identifies a large number of DNS queries for "wpad" or "isatap" from multiple internal devices within a network. This could indicate an attempt to exploit the WPAD protocol to redirect network traffic to a malicious server.

• Threat: Attackers can use tools like Responder or Inveigh to intercept these WPAD requests and respond with a fake server. This allows them to capture sensitive information like NTLM credentials or redirect web traffic through a malicious proxy.

• Detection Criteria:

  • The query checks DNS activity logs for requests containing "wpad" or "isatap" within the last hour.
  • It looks for successful DNS responses (indicated by "NOERROR").
  • It counts the number of unique internal hosts making these requests.
  • An alert is triggered if more than five unique hosts are making such queries.

• Alert Details:

  • The alert provides information on the number of hosts involved and the specific DNS query.
  • It warns that if there is no legitimate corporate WPAD server, the network might be vulnerable to credential theft.

• Severity and Techniques:

  • The severity level is set to medium.
  • The query is associated with credential access and collection tactics, specifically referencing the MITRE technique T1557.001, which involves poisoning network protocols to capture credentials.

Overall, this query helps network administrators identify and respond to potential WPAD abuse, which could lead to unauthorized access and data breaches.