DNS Server Discovery Via LDAP Query

Title: DNS Server Discovery Via LDAP Query
Status: test
Description:Detects DNS server discovery via LDAP query requests from uncommon applications
References:
  -https://github.com/redcanaryco/atomic-red-team/blob/980f3f83fd81f37c1ca9c02dccfd1c3d9f9d0841/atomics/T1016/T1016.md#atomic-test-9---dns-server-discovery-using-nslookup
  -https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/7fcdce70-5205-44d6-9c3a-260e616a2f04
Author: frack113
Date: 2022-08-20
modified:2023-09-18
Tags:

• -'attack.discovery'
• -'attack.t1482'

Logsource:

• product: windows
• category: dns_query

Detection:
  selection:
    QueryName|startswith: '_ldap.'
  filter_main_generic:
    Image|contains:
      -':\Program Files\'
      -':\Program Files (x86)\'
      -':\Windows\'

  filter_main_defender:
    Image|contains: ':\ProgramData\Microsoft\Windows Defender\Platform\'
    Image|endswith: '\MsMpEng.exe'
  filter_main_unknown:
    Image: '<unknown process>'
  filter_optional_azure:
    Image|startswith: 'C:\WindowsAzure\GuestAgent'
  filter_main_null:
    Image: 'None'
  filter_optional_browsers:
    Image|endswith:
      -'\chrome.exe'
      -'\firefox.exe'
      -'\opera.exe'

  condition:selection and not 1 of filter_main_* and not 1 of filter_optional_*
Falsepositives:
  -Likely
Level: low