Suspicious Named Error

Title: Suspicious Named Error
Status: test
Description:Detects suspicious DNS error messages that indicate a fatal or suspicious error that could be caused by exploiting attempts
References:
  -https://github.com/ossec/ossec-hids/blob/1ecffb1b884607cb12e619f9ab3c04f530801083/etc/rules/named_rules.xml
Author: Florian Roth (Nextron Systems)
Date: 2018-02-20
modified:2022-10-05
Tags:

• -'attack.initial-access'
• -'attack.t1190'

Logsource:

• product: linux
• service: syslog

Detection:
  keywords:
    - ' dropping source port zero packet from '
    - ' denied AXFR from '
    - ' exiting (due to fatal error)'
  condition:keywords
Falsepositives:
  -Unknown
Level: high