Elastic unknown experimental kql

Suspicious DNS TXT Record Lookups by Process

Leveraging aggregation by process executable entities, this hunt identifies identifies a high number of DNS TXT record queries from same process. Adversaries may leverage DNS TXT queries to stage malicious content or exfiltrate data.

View Source

Detection Logic

from logs-endpoint.events.network-*, logs-windows.sysmon_operational-*
| where host.os.family == "windows" and event.category == "network" and
  event.action in ("lookup_requested", "DNSEvent (DNS query)") and
  (dns.question.type == "TXT" or dns.answers.type == "TXT") and process.executable != "C:\\Windows\\system32\\svchost.exe"
| keep process.executable,  process.entity_id
| stats occurrences = count(*) by process.entity_id, process.executable
 /* threshold can be adjusted to your env */
| where occurrences >= 50

False Positives

  • ⚠ This hunt returns a list of processes unique pids and executable paths that performs a high number of DNS TXT lookups.
  • ⚠ Pivoting by `process.entity_id` will allow further investigation (parent process, hash, child processes, other network events etc.).

Field Validations

Loading…

Comments (0)

Loading comments...