Goal

Detects an anomalous volume of NXDOMAIN DNS responses returned to a single source IP.

Strategy

This rule monitors OCSF DNS Activity events where @ocsf.class_uid is 4003 and the response code @ocsf.rcode_id is 3 (NXDOMAIN), grouped by @ocsf.src_endpoint.ip. A spike of resolution failures from one host is a hallmark of domain generation algorithms (DGAs), where malware iterates through pseudo-random candidate domains until it reaches a live C2 endpoint.

Triage and response

• Examine the hostnames queried by {{@ocsf.src_endpoint.ip}} and determine whether they share a DGA-like pattern (random character distribution, identical length, shared TLD).
• Identify the process or workload on {{@ocsf.src_endpoint.ip}} driving the requests and verify it has a legitimate reason to be resolving the observed domains.
• Determine if endpoint detection products on the host reported related execution, persistence, or beaconing activity around the same time.