Elastic medium stable kql

Abnormally Large DNS Response

Specially crafted DNS requests can manipulate a known overflow vulnerability in some Windows DNS servers, resulting in Remote Code Execution (RCE) or a Denial of Service (DoS) from crashing the service.

View Source

Detection Logic

((event.category:(network or network_traffic) and destination.port:53) 
      or network.protocol:"dns" 
      or data_stream.dataset:(network_traffic.dns or zeek.dns)
      or (event.module:corelight and event.dataset:dns))
    and destination.bytes >= 65000
    and event.type:("allowed" or "end" or "protocol" or "start")
and not (
  event.duration > 60000000000
  and (
    event.action:("flow_terminated" or "network_flow")
    or data_stream.dataset:zeek.connection
    or (event.module:corelight and event.dataset:conn)
  )
)

Field Validations

Loading…

Comments (0)

Loading comments...