Detect Unusualsuspicious RTT Values Based On DNS Answers
Query
DeviceNetworkEvents
| extend TTLs = todynamic(tostring(parse_json(AdditionalFields).TTLs))
| mv-expand TTLs
| extend answers = todynamic(tostring(parse_json(AdditionalFields).answers))
| extend answersext = todynamic(tostring(parse_json(AdditionalFields).answers))
| extend rtt = todynamic(tostring(parse_json(AdditionalFields).rtt))
| extend query = (tostring(parse_json(AdditionalFields).query))
| mv-expand answers
| extend Type =
case(
answers matches regex @"^(\d{1,3}\.){3}\d{1,3}$", "IPv4",
answers matches regex @"^([a-fA-F0-9:]+)$", "IPv6",
answers contains ".", "URL",
"Unknown"
)
| where Type has "IPv4"
| extend tostring(answers)
| extend Geo_info_answer = tostring(geo_info_from_ip_address(answers).country)
| extend Geo_info_RemoteIP = tostring(geo_info_from_ip_address(RemoteIP).country)
| where rtt > 100
| project DeviceName, RemoteIP,answers,Geo_info_RemoteIP, Geo_info_answer,rtt, TTLsAbout this query
MITRE ATT&CK Technique(s)
| Technique ID | Title |
|---|---|
| T1071.004 | Application Layer Protocol: DNS |
Author: Sergio Albea (14/03/2025)
Detect unusual/suspicious RTT values based on DNS Answers
Description: Round Trip Time (RTT) analysis is a powerful value for threat hunting, revealing:
- C2 servers hosted in unusual locations (High RTT). (| where rtt > 100)
- Malware hiding inside local networks (Low RTT). (| where rtt < 5 )
- DNS tunneling activity based on RTT anomalies.
- Tor/VPN evasion techniques (RTT fluctuation detection).
- Compromised infrastructure using offshore hosting (Known malicious IPs with high RTT).
Explanation
This query is designed to detect unusual or suspicious DNS activity by analyzing Round Trip Time (RTT) values. Here's a simple breakdown of what it does:
-
Data Source: It uses network event data, specifically focusing on DNS queries and responses.
-
RTT Analysis: The query looks at the RTT, which is the time it takes for a DNS query to go to a server and back. Unusually high RTT values (greater than 100 milliseconds) are flagged as potentially suspicious.
-
Purpose: The goal is to identify:
- Command and Control (C2) servers that might be located in unusual or distant locations.
- Malware that might be operating within local networks.
- DNS tunneling activities, which can indicate data exfiltration.
- Evasion techniques using Tor or VPNs, which can cause RTT fluctuations.
- Compromised infrastructure using offshore hosting.
-
Data Processing:
- The query extracts and processes additional fields from the network events, such as TTLs (Time to Live), answers, and RTT.
- It identifies the type of DNS answer (e.g., IPv4, IPv6, URL).
- It focuses on IPv4 addresses for further analysis.
-
Geolocation:
- The query retrieves geographical information for both the DNS answer and the remote IP address to help identify unusual locations.
-
Output:
- It projects (displays) relevant information such as the device name, remote IP, DNS answers, geographical information, RTT, and TTLs for further investigation.
In summary, this query helps in threat hunting by identifying DNS activities with unusual RTT values, which could indicate malicious behavior or network anomalies.
