NULL and ANY DNS Record Type Queries — Tunneling Indicator
13 DNS NULL ANY Tunneling
Query
ASimDnsActivityLogs
| where TimeGenerated > ago(1h)
| where DnsQueryTypeName in~ ("NULL", "ANY")
or DnsQueryType in (10, 255)
| summarize
NullAnyCount = count(),
UniqueDomains = dcount(DnsQuery),
RecordTypes = make_set(DnsQueryTypeName),
SampleDomains = make_set(DnsQuery, 10),
FirstSeen = min(TimeGenerated),
LastSeen = max(TimeGenerated)
by SrcIpAddr, SrcHostname
| where NullAnyCount > 15Explanation
This query is designed to detect suspicious DNS activity that might indicate DNS tunneling, a technique often used for malicious purposes like data exfiltration or command and control. Here's a simple breakdown:
-
Purpose: The query looks for DNS queries of types "NULL" (type 10) and "ANY" (type 255), which are rarely used for legitimate purposes in corporate environments but are commonly used by DNS tunneling tools.
-
Detection Criteria:
- It checks DNS activity logs from the past hour.
- It counts how many times these specific DNS query types are used.
- It identifies unique domains queried and records the first and last time these queries were seen.
-
Alert Conditions:
- An alert is triggered if there are more than 15 such queries from a single source IP address or hostname within the past hour.
-
Severity and Tactics:
- The severity of this detection is marked as "Medium."
- It relates to tactics like "Command and Control" and "Exfiltration," indicating potential malicious activity.
-
Output:
- The query provides details such as the number of suspicious queries, unique domains involved, and the time range of the activity.
- Alerts are customized to display the source hostname and IP address, along with the count of unusual queries and sample domains involved.
-
Entity Mapping:
- It maps the source hostname and IP address to corresponding entities for further investigation.
Overall, this query helps security teams identify and investigate potential DNS tunneling activities by flagging unusual DNS query types that have little to no legitimate use in a corporate setting.
