Name:DNS Query Length With High Standard Deviation id:1a67f15a-f4ff-4170-84e9-08cf6f75d6f5 version:7 date:2024-09-30 author:Bhavin Patel, Splunk status:production type:Anomaly Description:The following analytic identifies DNS queries with unusually large lengths by computing the standard deviation of query lengths and filtering those exceeding twice the standard deviation. It leverages DNS query data from the Network_Resolution data model, focusing on the length of the domain names being resolved. This activity is significant as unusually long DNS queries can indicate data exfiltration or command-and-control communication attempts. If confirmed malicious, this activity could allow attackers to stealthily transfer data or maintain persistent communication channels within the network. Data_source:
-Sysmon EventID 22
search:| tstats `security_content_summariesonly` count from datamodel=Network_Resolution where NOT DNS.record_type IN("Pointer","PTR") by DNS.query host| `drop_dm_object_name("DNS")` | eval tlds=split(query,".") | eval tld=mvindex(tlds,-1) | eval tld_len=len(tld) | search tld_len<=24 | eval query_length = len(query) | table host query query_length record_type count | eventstats stdev(query_length) AS stdev avg(query_length) AS avg p50(query_length) AS p50| where query_length>(avg+stdev*2) | eval z_score=(query_length-avg)/stdev | `dns_query_length_with_high_standard_deviation_filter`
how_to_implement:To successfully implement this search, you will need to ensure that DNS data is populating the Network_Resolution data model. known_false_positives:It's possible there can be long domain names that are legitimate. References: drilldown_searches: name:'View the detection results for - "$host$"' search:'%original_detection_search% | search host = "$host$"' earliest_offset:'$info_min_time$' latest_offset:'$info_max_time$' name:'View risk events for the last 7 days for - "$host$"' search:'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$host$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset:'$info_min_time$' latest_offset:'$info_max_time$' tags: analytic_story: - 'Hidden Cobra Malware' - 'Suspicious DNS Traffic' - 'Command And Control' asset_type:Endpoint confidence:80 impact:70 message:A dns query $query$ with 2 time standard deviation of name len of the dns query in host $host$ mitre_attack_id: - 'T1048.003' - 'T1048' observable: name:'host' type:'Hostname' - role: - 'Victim' product: - 'Splunk Enterprise' - 'Splunk Enterprise Security' - 'Splunk Cloud' required_fields: - '_time' - 'DNS.query' risk_score:56 security_domain:network
