Classification:

attack

Tactic:

TA0011-command-and-control

Technique:

T1071-application-layer-protocol

VIEW RULE IN DATADOG VIEW SIGNALS

Set up the zeek integration.

Goal

Zeek generic DNS tunnel detected.

Strategy

This rule monitors Zeek logs for the generic DNS tunnel detector. The algorithm detects DNS tunnels without requiring use of signatures for every DNS tunneling tool. Since the algorithm measures information transfer, it is capable of detecting non-malicious tunnels that occur all the time. Attackers use DNS tunneling for command and control communications, as it is crucial to network operations and security monitoring visibility may be limited.

Triage and response

1. Assess {{@dns.question.name}} domain reputation to determine if domain has been noted as malicious by vendors.
2. Check for other signals from the originating device as a possible indication that the device has been compromised.
3. If it is determined that the activity is malicious:
   • Block the domain, if it aligns with organization incident response processes.
   • Begin your organization’s incident response process and investigate.