KQL Search

Query Details

HomeAI ToolsDevice Query

Anomalies Domain Generation Algorithm DGA On DNS Domains

Query

//The Anomaly rule "Domain generation algorithm (DGA) on DNS domains" should have excluded private TLD domains
let _RareBenignDomains = toscalar(
    _GetWatchlist("Domain-RareBenignDomains")
    | summarize make_list(Domain)
    );
Anomalies
| where (RuleName endswith "Domain generation algorithm (DGA) on DNS domains" or RuleName endswith "Potential domain generation algorithm (DGA) on next-level DNS Domains")
    and RuleStatus != "Flighting"
| extend
    Domain = AnomalyDetails["Observables"][iff(RuleName has "Potential", 2, 3)]["Value"],
    SourceIPAddress = tostring(Entities[0]["Address"])
| mv-expand Domain to typeof(string)
| summarize
    TimeGenerated = min(TimeGenerated),
    SourceIPAddresses = make_set(SourceIPAddress),
    SourceIPAddressesCount = dcount(SourceIPAddress),
    take_any(Tactics, Techniques)
    by Domain, RuleName
| extend
    SLD = extract(@"([^\.]+\.[^\.]+)$", 1, Domain),
    TLD = extract(@"[^\.]+\.([^\.]+)$", 1, Domain)
| where not(SLD in (_RareBenignDomains))
| project
    TimeGenerated,
    RuleName,
    Domain,
    SLD,
    TLD,
    SourceIPAddressesCount,
    SourceIPAddresses,
    Tactics,
    Techniques

Explanation

This query is looking for anomalies related to domain generation algorithms (DGA) on DNS domains. It excludes any private top-level domains (TLDs) that are listed in a watchlist called "Domain-RareBenignDomains". The query retrieves information such as the time generated, rule name, domain, second-level domain (SLD), top-level domain (TLD), source IP addresses, and associated tactics and techniques.

Details

Jose Sebastián Canós profile picture

Jose Sebastián Canós

Released: December 15, 2022

Tables

Anomalies

Keywords

Anomalies,RuleName,Domain,SourceIPAddress,TimeGenerated,SourceIPAddresses,SourceIPAddressesCount,Tactics,Techniques,SLD,TLD,_RareBenignDomains

Operators

toscalar_GetWatchlistsummarizemake_listwhereendswithor!=extendAnomalyDetailsiffhasmv-expandtypeofmintostringdcounttake_anybyextractinnotproject

Actions