Generic DNS tunnel detected by Zeek

This rule is part of a beta feature. To learn more, contact Support.
zeek

Classification:

attack

Tactic:

TA0011-command-and-control

Technique:

T1071-application-layer-protocol

Set up the zeek integration.

Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel, n'hésitez pas à nous contacter.

Goal

Zeek generic DNS tunnel detected.

Strategy

This rule monitors Zeek logs for the generic DNS tunnel detector. The algorithm detects DNS tunnels without requiring use of signatures for every DNS tunneling tool. Since the algorithm measures information transfer, it is capable of detecting non-malicious tunnels that occur all the time. Attackers use DNS tunneling for command and control communications, as it is crucial to network operations and security monitoring visibility may be limited.

Triage and response

  1. Assess {{@dns.question.name}} domain reputation to determine if domain has been noted as malicious by vendors.
  2. Check for other signals from the originating device as a possible indication that the device has been compromised.
  3. If it is determined that the activity is malicious:
    • Block the domain, if it aligns with organization incident response processes.
    • Begin your organization’s incident response process and investigate.