KQL Search

Query Details

DNS Query to Threat-Intelligence Domain Indicator

19 DNS Threat Intel Domain Match

Query

let TIDomains =
    ThreatIntelIndicators
    | where IsActive == true and Revoked == false
    | where ObservableKey in~ ("domain-name:value", "hostname:value")
    | where isnotempty(ObservableValue)
    | summarize by TIDomain = tolower(ObservableValue);
ASimDnsActivityLogs
| where TimeGenerated > ago(1h)
| where isnotempty(DnsQuery)
| extend q = tolower(DnsQuery)
| join kind=inner (TIDomains) on $left.q == $right.TIDomain
| summarize
    Requests  = count(),
    Clients   = make_set(SrcIpAddr, 20),
    Hostnames = make_set(SrcHostname, 20),
    FirstSeen = min(TimeGenerated),
    LastSeen  = max(TimeGenerated)
  by DnsQuery
| extend ThreatLevel = "🔴 Critical"

Explanation

This query is designed to detect potentially malicious activity by monitoring DNS queries against a list of known-bad domains or hostnames. Here's a simplified breakdown of what it does:

  1. Purpose: It checks if any DNS queries made by clients match domains or hostnames listed as threats in a threat intelligence feed. If a match is found, it indicates a high likelihood of malicious activity, such as malware communication, phishing, or contact with compromised infrastructure.

  2. Data Sources: The query requires two data connectors:

    • WindowsDnsAma: Provides DNS activity logs.
    • ThreatIntelligence: Provides threat intelligence indicators.

  3. Process:

    • It filters active and non-revoked threat intelligence indicators for domains and hostnames.
    • It then compares these indicators against DNS queries made in the last hour.
    • If a DNS query matches a known-bad domain or hostname, it collects information such as the number of requests, client IP addresses, hostnames, and the first and last time the domain was queried.

  4. Output:

    • The query results in an alert if any matches are found, indicating a critical threat level.
    • The alert includes details like the number of times the domain was queried, the clients involved, and timestamps of the first and last queries.

  5. Alert Details:

    • The alert is formatted to display the domain queried and the number of times it was resolved.
    • It provides a description for further investigation, suggesting that the involved clients should be checked for potential compromise.

  6. Relevance:

    • This query is associated with the MITRE ATT&CK technique T1071.004, which involves using DNS as an application layer protocol for command and control (C2) communication.

In summary, this query is a security measure to identify and alert on DNS queries to domains flagged as threats, helping to detect and respond to potential security incidents.