KQL Search

This query is designed to detect suspicious DNS activity that might indicate an internal network reconnaissance attempt following a security breach. It specifically looks for computers (clients) that make an unusually high number of unique DNS queries for internal hostnames within a short time frame (30 minutes). This behavior is often associated with attackers trying to map out the network by identifying key resources like domain controllers and file servers.

Key points of the query:

• It monitors DNS activity logs for the last 30 minutes.
• It identifies computers that have queried more than 750 unique internal hostnames in this period.
• Normal workstations typically query fewer than 100 unique hostnames per hour, so exceeding this threshold is considered suspicious.
• The query calculates the number of queries per minute and provides a sample of the queried domains.
• If the threshold is exceeded, an alert is generated, indicating potential network reconnaissance activity.
• The alert includes details like the hostname and IP address of the querying computer, the number of unique domains queried, and the rate of queries per minute.
• This detection method is associated with tactics and techniques from the MITRE ATT&CK framework, specifically related to network discovery and system enumeration.

Overall, this query helps identify potential malicious activity by flagging unusual DNS query patterns that could suggest an attacker is mapping the network.