Detect Unusualsuspicious TTL Values Based On DNS Answers
Query
DeviceNetworkEvents
| extend TTLs = todynamic(tostring(parse_json(AdditionalFields).TTLs))
| mv-expand TTLs
| extend answers = todynamic(tostring(parse_json(AdditionalFields).answers))
| extend answersext = todynamic(tostring(parse_json(AdditionalFields).answers))
| extend query = (tostring(parse_json(AdditionalFields).query))
| mv-expand answers
| extend Type =
case(
answers matches regex @"^(\d{1,3}\.){3}\d{1,3}$", "IPv4",
answers matches regex @"^([a-fA-F0-9:]+)$", "IPv6",
answers contains ".", "URL",
"Unknown"
)
| where Type has "IPv4"
| extend tostring(answers)
| extend Geo_info_answer = tostring(geo_info_from_ip_address(answers).country)
| extend Geo_info_RemoteIP = tostring(geo_info_from_ip_address(RemoteIP).country)
| where TTLs > 86400
| project DeviceName, RemoteIP,answers,Geo_info_RemoteIP, Geo_info_answer, TTLsAbout this query
MITRE ATT&CK Technique(s)
| Technique ID | Title |
|---|---|
| T1071.004 | Application Layer Protocol: DNS |
Author: Sergio Albea (14/03/2025)
Detect unusual/suspicious TTL values based on DNS Answers
Description: Time to live (TTL) values in DNS responses provide valuable threat-hunting insights, including:
- Fast-flux botnets (rotating IPs with low TTLs).
- Malware C2 detection (extremely low TTLs). ( | where TTLs < 10 )
- DNS tunneling (high TTLs or changing TTLs). ( | where TTLs > 86400 )
- Fake domains mimicking real services (TTL anomalies).
- Evasive infrastructure constantly changing TTL values.
Explanation
This query is designed to detect unusual or suspicious Time to Live (TTL) values in DNS responses, which can be indicative of various cyber threats. Here's a simplified breakdown of what the query does:
-
Data Source: It starts by examining network events from devices, specifically looking at DNS-related data.
-
Extracting TTL Values: The query extracts TTL values from the DNS responses. TTL is a value that indicates how long a DNS response should be cached.
-
Expanding Data: It expands the list of TTLs and DNS answers to analyze each one individually.
-
Classifying Answers: The query classifies each DNS answer into types such as IPv4, IPv6, or URL based on its format.
-
Filtering for IPv4: It filters the results to focus only on IPv4 addresses.
-
Geolocation Information: For each IPv4 address, it retrieves geographical information, such as the country associated with the IP address.
-
Identifying Suspicious TTLs: The query specifically looks for DNS responses with TTL values greater than 86400 seconds (24 hours), which can be suspicious and indicative of DNS tunneling or other evasive techniques.
-
Output: Finally, it projects (displays) relevant information such as the device name, remote IP, DNS answer, and geographical information for further analysis.
In summary, this query helps identify potential threats by analyzing DNS responses with unusually high TTL values, which could suggest malicious activities like DNS tunneling or the use of evasive infrastructure.
