DNS Query to Threat-Intelligence Domain Indicator
19 DNS Threat Intel Domain Match
Query
let TIDomains =
ThreatIntelIndicators
| where IsActive == true and Revoked == false
| where ObservableKey in~ ("domain-name:value", "hostname:value")
| where isnotempty(ObservableValue)
| summarize by TIDomain = tolower(ObservableValue);
ASimDnsActivityLogs
| where TimeGenerated > ago(1h)
| where isnotempty(DnsQuery)
| extend q = tolower(DnsQuery)
| join kind=inner (TIDomains) on $left.q == $right.TIDomain
| summarize
Requests = count(),
Clients = make_set(SrcIpAddr, 20),
Hostnames = make_set(SrcHostname, 20),
FirstSeen = min(TimeGenerated),
LastSeen = max(TimeGenerated)
by DnsQuery
| extend ThreatLevel = "🔴 Critical"Explanation
This query is designed to detect potentially malicious activity by monitoring DNS queries against a list of known-bad domains or hostnames. Here's a simplified breakdown of what it does:
-
Purpose: It checks if any DNS queries made by clients match domains or hostnames listed as threats in a threat intelligence feed. If a match is found, it indicates a high likelihood of malicious activity, such as malware communication, phishing, or contact with compromised infrastructure.
-
Data Sources: The query requires two data connectors:
- WindowsDnsAma: Provides DNS activity logs.
- ThreatIntelligence: Provides threat intelligence indicators.
-
Process:
- It filters active and non-revoked threat intelligence indicators for domains and hostnames.
- It then compares these indicators against DNS queries made in the last hour.
- If a DNS query matches a known-bad domain or hostname, it collects information such as the number of requests, client IP addresses, hostnames, and the first and last time the domain was queried.
-
Output:
- The query results in an alert if any matches are found, indicating a critical threat level.
- The alert includes details like the number of times the domain was queried, the clients involved, and timestamps of the first and last queries.
-
Alert Details:
- The alert is formatted to display the domain queried and the number of times it was resolved.
- It provides a description for further investigation, suggesting that the involved clients should be checked for potential compromise.
-
Relevance:
- This query is associated with the MITRE ATT&CK technique T1071.004, which involves using DNS as an application layer protocol for command and control (C2) communication.
In summary, this query is a security measure to identify and alert on DNS queries to domains flagged as threats, helping to detect and respond to potential security incidents.
Details
David Alonso
Released: July 28, 2026
Tables
Keywords
Operators
Severity
HighTactics
MITRE Techniques
Frequency: 1h
Period: 1h