Generic DNS tunnel detected by Zeek

This rule is part of a beta feature. To learn more, contact Support.
zeek

Classification:

attack

Tactic:

TA0011-command-and-control

Technique:

T1071-application-layer-protocol

Set up the zeek integration.

このページは日本語には対応しておりません。随時翻訳に取り組んでいます。翻訳に関してご質問やご意見ございましたら、お気軽にご連絡ください。

Goal

Zeek generic DNS tunnel detected.

Strategy

This rule monitors Zeek logs for the generic DNS tunnel detector. The algorithm detects DNS tunnels without requiring use of signatures for every DNS tunneling tool. Since the algorithm measures information transfer, it is capable of detecting non-malicious tunnels that occur all the time. Attackers use DNS tunneling for command and control communications, as it is crucial to network operations and security monitoring visibility may be limited.

Triage and response

  1. Assess {{@dns.question.name}} domain reputation to determine if domain has been noted as malicious by vendors.
  2. Check for other signals from the originating device as a possible indication that the device has been compromised.
  3. If it is determined that the activity is malicious:
    • Block the domain, if it aligns with organization incident response processes.
    • Begin your organization’s incident response process and investigate.