command_and_control_dns_tunneling_nslookup.toml

[metadata]
creation_date = "2020/11/11"
maturity = "production"
updated_date = "2021/09/23"

[rule]
author = ["Elastic"]
description = """
This rule identifies a large number (15) of nslookup.exe executions with an explicit query type from the same host. This
may indicate command and control activity utilizing the DNS protocol.
"""
from = "now-9m"
index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.*"]
language = "kuery"
license = "Elastic License v2"
name = "Potential DNS Tunneling via NsLookup"
references = ["https://unit42.paloaltonetworks.com/dns-tunneling-in-the-wild-overview-of-oilrigs-dns-tunneling/"]
risk_score = 47
rule_id = "3a59fc81-99d3-47ea-8cd6-d48d561fca20"
severity = "medium"
tags = ["Elastic", "Host", "Windows", "Threat Detection", "Command and Control"]
type = "threshold"

query = '''
event.category:process and event.type:start and process.name:nslookup.exe and process.args:(-querytype=* or -qt=* or -q=* or -type=*)
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1071"
name = "Application Layer Protocol"
reference = "https://attack.mitre.org/techniques/T1071/"

  [[rule.threat.technique.subtechnique]]
  id = "T1071.004"
  name = "DNS"
  reference = "https://attack.mitre.org/techniques/T1071/004/"


[rule.threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[rule.threshold]
field = ["host.id"]
value = 15