KQL Search

id: a1b2c3d4-0007-4a5b-8c9d-dns007rebinding
name: DNS Rebinding — Rapid TTL Change for Same Domain
description: |
  Detects DNS rebinding preparation by identifying domains that resolve to
  multiple different IP addresses within a short window with rapid re-resolution.
  In a DNS rebinding attack, the attacker's domain initially resolves to a public
  IP, then switches to an internal/loopback IP (127.0.0.1, 192.168.x.x, 0.0.0.0)
  after the TTL expires. This allows JavaScript from the attacker's domain to
  access internal services by bypassing the browser's Same-Origin Policy.
  Ref: GitHub Security Lab — "DNS rebinding attacks explained"
  Ref: Singularity of Origin (NCC Group), rbndr (Tavis Ormandy)
severity: Medium
requiredDataConnectors:
  - connectorId: WindowsDnsAma
    dataTypes:
      - ASimDnsActivityLogs
queryFrequency: 30m
queryPeriod: 30m
triggerOperator: gt
triggerThreshold: 0
status: Available
tactics:
  - LateralMovement
  - DefenseEvasion
relevantTechniques:
  - T1557
  - T1090
tags:
  - DNS Rebinding
  - Same-Origin Policy Bypass
  - SSRF
  - Browser-based attack
query: |
  ASimDnsActivityLogs
  | where TimeGenerated > ago(30m)
  | where EventResult =~ "Success"
  | where DnsAnswerCount > 0
  | summarize
      QueryCount      = count(),
      FirstSeen       = min(TimeGenerated),
      LastSeen        = max(TimeGenerated),
      SrcHostname     = any(SrcHostname)
    by SrcIpAddr, DnsQuery
  | where QueryCount >= 5
  | extend SpanSeconds = datetime_diff('second', LastSeen, FirstSeen)
  | where SpanSeconds > 0
  | extend ReResolutionRate = round(todouble(QueryCount) / todouble(SpanSeconds) * 60.0, 2)
  | where ReResolutionRate >= 2
  | project
      SrcIpAddr,
      SrcHostname,
      DnsQuery,
      QueryCount,
      ReResolutionRate,
      SpanSeconds,
      FirstSeen,
      LastSeen
entityMappings:
  - entityType: Host
    fieldMappings:
      - identifier: HostName
        columnName: SrcHostname
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: SrcIpAddr
  - entityType: DNS
    fieldMappings:
      - identifier: DomainName
        columnName: DnsQuery
alertDetailsOverride:
  alertDisplayNameFormat: "DNS Rebinding — {{SrcHostname}} re-resolved {{DnsQuery}} {{QueryCount}} times"
  alertDescriptionFormat: "Potential DNS rebinding: {{SrcHostname}} re-resolved {{DnsQuery}} {{QueryCount}} times in {{SpanSeconds}} seconds ({{ReResolutionRate}} re-resolutions/min). Attackers use rapid TTL expiry to redirect domain from public to internal IP."
customDetails:
  ReResolutionRate: ReResolutionRate
  TargetDomain: DnsQuery