KQL Search

Query Details

DNS Tunneling via High-Volume TXT Record Queries

01 DNS Tunneling TXT High Volume

Query

ASimDnsActivityLogs
| where TimeGenerated > ago(1h)
| where DnsQueryTypeName =~ "TXT"
| summarize
    TxtQueryCount  = count(),
    UniqueDomains  = dcount(DnsQuery),
    SampleDomains  = make_set(DnsQuery, 10),
    FirstSeen      = min(TimeGenerated),
    LastSeen       = max(TimeGenerated)
  by SrcIpAddr, SrcHostname
| where TxtQueryCount > 250 and UniqueDomains > 20
| extend
    HostName = iif(isnotempty(SrcHostname), SrcHostname, SrcIpAddr),
    AlertDetail = strcat("Client sent ", tostring(TxtQueryCount),
                         " TXT queries across ", tostring(UniqueDomains), " unique domains")

Explanation

This query is designed to detect potential DNS tunneling activity by monitoring for an unusually high number of DNS TXT record queries from a client within a one-hour period. DNS tunneling is a technique used by attackers to send data through DNS queries, often for command and control (C2) communication or data exfiltration.

Key Points:

  • Purpose: Identify clients making a large number of TXT record DNS queries, which can indicate the use of DNS tunneling tools like iodine, dnscat2, or Cobalt Strike.
  • Focus: Specifically targets TXT records, which can carry up to 255 characters and are often used to encode commands or data.
  • Detection Criteria:
    • Looks for clients that have made more than 250 TXT queries to over 20 unique domains in the past hour.
  • Data Source: Uses logs from the ASimDnsActivityLogs data type, which is connected through the WindowsDnsAma connector.
  • Alert Details:
    • Generates an alert if the criteria are met, providing details such as the number of TXT queries, the number of unique domains queried, and sample domain names.
    • The alert includes the hostname or IP address of the client and a summary of the activity.
  • Severity: Classified as a high-severity alert due to the potential for malicious activity.
  • Tactics and Techniques: Related to command and control (T1071.004) and data exfiltration (T1048.003) tactics.

This query is a specialized rule that complements existing general DNS tunneling detection by focusing specifically on TXT records, which are commonly used in DNS tunneling attacks.