DNS MX Record Abuse for Payload Staging
14 DNS MX Payload Staging
Query
ASimDnsActivityLogs
| where TimeGenerated > ago(1h)
| where DnsQueryTypeName =~ "MX" or DnsQueryType == 15
| extend BaseDomain = strcat(
tostring(split(DnsQuery, ".")[-2]), ".",
tostring(split(DnsQuery, ".")[-1])
)
| extend SubdomainPrefix = tostring(split(DnsQuery, ".")[0])
| extend HasNumericPrefix = SubdomainPrefix matches regex @"^\d+$"
| summarize
MxQueryCount = count(),
NumericPrefixed = countif(HasNumericPrefix),
UniquePrefixes = dcount(SubdomainPrefix),
SampleDomains = make_set(DnsQuery, 15),
FirstSeen = min(TimeGenerated),
LastSeen = max(TimeGenerated)
by SrcIpAddr, SrcHostname, BaseDomain
| where MxQueryCount > 25 and NumericPrefixed > 5Explanation
This query is designed to detect a specific type of DNS abuse where MX (Mail Exchange) records are used for staging payloads, a technique known as "Octoberfest7." Here's a simple breakdown of what the query does:
-
Purpose: It identifies suspicious DNS activity where MX records are used to encode and store data, potentially for malicious purposes like command and control or data exfiltration.
-
Indicators: The query looks for:
- A high number of MX queries from hosts that are not mail servers.
- MX queries for the same domain that have numeric prefixes (e.g., 1.domain, 2.domain), which suggests an ordering mechanism for reassembling data.
-
Data Source: It uses DNS activity logs from Windows DNS servers.
-
Frequency: The query runs every hour and checks the past hour's data.
-
Detection Logic:
- It filters for MX queries.
- Extracts the base domain and checks if the subdomain has a numeric prefix.
- Summarizes the data by source IP address, hostname, and base domain.
- Flags cases where there are more than 25 MX queries and more than 5 with numeric prefixes.
-
Severity: The alert generated by this query is considered high severity.
-
Alert Details: If suspicious activity is detected, an alert is generated with details about the source hostname, IP address, number of MX queries, and the base domain involved.
-
Techniques and Tags: The query is associated with specific tactics and techniques (T1071.004, T1132) and tagged with relevant terms like "MX tunneling" and "Octoberfest7."
In summary, this query helps identify potential misuse of DNS MX records for covert data transfer, which is a technique used to bypass traditional security monitoring.
Details
David Alonso
Released: July 28, 2026
Tables
Keywords
Operators
Severity
HighTactics
Frequency: 1h
Period: 1h