Detect Malicious Answers By DNS Queries
Query
let IPList = externaldata (IP:string) ["https://raw.githubusercontent.com/stamparm/ipsum/refs/heads/master/ipsum.txt"] with(format="txt")
| where IP !startswith "#"
| extend IP_ = split(IP, " ")
| extend IP = tostring(IP_[0])
| extend BL = toint(IP_[1]);
DeviceNetworkEvents
| extend answers = todynamic(tostring(parse_json(AdditionalFields).answers))
| extend answersext = todynamic(tostring(parse_json(AdditionalFields).answers))
| extend query = (tostring(parse_json(AdditionalFields).query))
| mv-expand answers
| extend Type =
case(
answers matches regex @"^(\d{1,3}\.){3}\d{1,3}$", "IPv4",
answers matches regex @"^([a-fA-F0-9:]+)$", "IPv6",
answers contains ".", "URL",
"Unknown"
)
| where Type has "IPv4"
| extend tostring(answers)
| join kind=inner (IPList) on $left.answers == $right.IP
| extend Geo_info_answer = tostring(geo_info_from_ip_address(answers).country)
| extend Geo_info_RemoteIP = tostring(geo_info_from_ip_address(RemoteIP).country)
| where BL > 1
| summarize dcount(answers),make_set(answers),make_set(query),make_set(Geo_info_answer),make_set(ActionType) by DeviceName, RemoteIP, Geo_info_RemoteIP
| order by dcount_answersAbout this query
MITRE ATT&CK Technique(s)
| Technique ID | Title |
|---|---|
| T1071.004 | Application Layer Protocol: DNS |
Author: Sergio Albea (14/03/2025)
Detect Malicious IP answers by DNS queries
Description: The aim of this query is detect suspicious IP answers from DNS Queries, validating them with an external TI Feed and be alerted when there are some matches.
Explanation
This query is designed to detect potentially malicious IP addresses that are returned as answers in DNS queries. Here's a simplified breakdown of what the query does:
-
Load External Threat Intelligence Feed: It retrieves a list of suspicious IP addresses from an external source (a text file hosted on GitHub).
-
Filter and Format the IP List: The query processes this list to extract IP addresses and their associated threat level (BL - Blacklist score).
-
Analyze Device Network Events: It examines network events on devices, specifically looking at DNS query responses.
-
Extract and Classify Answers: The query extracts the answers from DNS queries and classifies them as IPv4, IPv6, URL, or Unknown based on their format.
-
Filter for IPv4 Addresses: It focuses on answers that are IPv4 addresses.
-
Match Against Threat Intelligence: The query checks if any of these IPv4 addresses match the suspicious IPs from the threat intelligence feed.
-
Geolocation Information: It retrieves geographical information for the matched IP addresses and the remote IP addresses involved in the network events.
-
Filter by Threat Level: It only considers IP addresses with a blacklist score greater than 1, indicating a higher threat level.
-
Summarize Results: The query summarizes the findings, counting distinct suspicious IPs, and grouping them by device name, remote IP, and geographical information.
-
Order Results: Finally, it orders the results by the count of distinct suspicious IPs detected.
In essence, this query helps identify and alert on DNS query responses that contain IP addresses flagged as suspicious by an external threat intelligence source, providing additional context such as geographical information and the devices involved.
Details
Sergio Albea
Released: July 21, 2026
Tables
Keywords
Operators
MITRE Techniques