DNS Hijacking

• DNS Query Requests Resolved by Unauthorized DNS Servers :
  network Endpoint risk_score:25 2024-10-17 version:5
  This search will detect DNS requests resolved by unauthorized DNS servers. Legitimate DNS servers should be identified in the Enterprise Security Assets and Identity Framework.


• DNS record changed :
  network Endpoint risk_score:25 2024-10-17 version:5
  The search takes the DNS records and their answers results of the discovered_dns_records lookup and finds if any records have changed by searching DNS response from the Network_Resolution datamodel across the last day.


• Clients Connecting to Multiple DNS Servers :
  network Endpoint risk_score:25 2024-10-17 version:5
  This search allows you to identify the endpoints that have connected to more than five DNS servers and made DNS Queries over the time frame of the search.


• Detect DGA domains using pretrained model in DSDL :
  network Endpoint risk_score:63 2024-10-17 version:3
  The following analytic identifies Domain Generation Algorithm (DGA) generated domains using a pre-trained deep learning model. It leverages the Network Resolution data model to analyze domain names and detect unusual character sequences indicative of DGA activity. This behavior is significant as adversaries often use DGAs to generate numerous domain names for command-and-control servers, making it harder to block malicious traffic. If confirmed malicious, this activity could enable attackers to maintain persistent communication with compromised systems, evade detection, and execute further malicious actions.


• Detect DNS Data Exfiltration using pretrained model in DSDL :
  network Endpoint risk_score:45 2024-10-17 version:3
  The following analytic identifies potential DNS data exfiltration using a pre-trained deep learning model. It leverages DNS request data from the Network Resolution datamodel and computes features from past events between the same source and domain. The model generates a probability score (pred_is_exfiltration_proba) indicating the likelihood of data exfiltration. This activity is significant as DNS tunneling can be used by attackers to covertly exfiltrate sensitive data. If confirmed malicious, this could lead to unauthorized data access and potential data breaches, compromising the organization's security posture.


• Detect suspicious DNS TXT records using pretrained model in DSDL :
  network Endpoint risk_score:45 2024-10-17 version:3
  The following analytic identifies suspicious DNS TXT records using a pre-trained deep learning model. It leverages DNS response data from the Network Resolution data model, categorizing TXT records into known types via regular expressions. Records that do not match known patterns are flagged as suspicious. This activity is significant as DNS TXT records can be used for data exfiltration or command-and-control communication. If confirmed malicious, attackers could use these records to covertly transfer data or receive instructions, posing a severe threat to network security.


• Detect hosts connecting to dynamic domain providers :
  network Endpoint risk_score:56 2024-09-30 version:5
  The following analytic identifies DNS queries from internal hosts to dynamic domain providers. It leverages DNS query logs from the `Network_Resolution` data model and cross-references them with a lookup file containing known dynamic DNS providers. This activity is significant because attackers often use dynamic DNS services to host malicious payloads or command-and-control servers, making it crucial for security teams to monitor. If confirmed malicious, this activity could allow attackers to bypass firewall blocks, evade detection, and maintain persistent access to the network.