Skip to content

Suspicious DNS Activity๐Ÿ”—

The Suspicious DNS Activity detectors identify attempts by threat actors to steal data by exfiltration over existing command and control channels. This detector monitors DNS activity for sequences and patterns indicative of possible DNS exfiltration or C2 communication over DNS to an attacker machine from a compromised host.

Suspicious DNS Activity Detection

Requirements๐Ÿ”—

This detector requires the following data sources, integrations, or schemas:

  • DNS
Inputs๐Ÿ”—

Detections are from the following normalized sources:

  • DNS

Outputs๐Ÿ”—

Detections from this detector are pushed to the XDR Detection Database and Detection Triage Dashboard.

Configuration Options๐Ÿ”—

This detector is enabled by default when the required data sources or integrations are available in the tenant.

MITRE ATT&CK Category๐Ÿ”—

  • MITRE Enterprise ATT&CK - Exfiltration - Exfiltration Over C2 Channel. For more information, see MITRE Technique T1041.
  • MITRE Enterprise ATT&CK - Command and Control - Application Layer Protocol: DNS. For more information, see MITRE Technique T1071.004.

Detector Testing๐Ÿ”—

This detector does have a supported testing method.

See DNS Query Detector Testing.

FROM detection WHERE metadata.creator.detector.detector_id='app:detect:suspicious-dns'

References๐Ÿ”—