KQL Search

This KQL (Kusto Query Language) query is designed to analyze DNS events to identify potential NXDOMAIN hijacking attempts. Here's a simple breakdown of what the query does:

1. Data Source: It starts by looking at a dataset called DnsEvents, which contains information about DNS queries.

2. Filtering Criteria:

   • The query filters for DNS names (Name) that match a specific pattern:
     • The name must be exactly 20 alphanumeric characters followed by ".com".
     • The name must include at least one uppercase letter.
   • It also filters for DNS queries of type "A" (IPv4 address) or "AAAA" (IPv6 address).

3. Projection:

   • After filtering, the query selects (or projects) specific columns from the data:
     • TimeGenerated: The time the event was generated.
     • Computer: The computer where the event was logged.
     • EventId: The ID of the event.
     • SubType: The subtype of the event.
     • ClientIP: The IP address of the client making the DNS query.
     • Name: The DNS name that was queried.
     • QueryType: The type of DNS query (either "A" or "AAAA").
     • ResultCode: The result code of the DNS query.

In summary, this query is used to identify and examine specific DNS queries that might indicate NXDOMAIN hijacking, focusing on queries for domain names that fit a particular pattern and are of specific query types.