Deprecated - Potential DNS Tunneling via Iodine

 1[metadata]
 2creation_date = "2020/02/18"
 3integration = ["endpoint"]
 4maturity = "production"
 5min_stack_comments = "New fields added: required_fields, related_integrations, setup"
 6min_stack_version = "8.3.0"
 7updated_date = "2023/08/25"
 8
 9[rule]
10author = ["Elastic"]
11description = """
12Iodine is a tool for tunneling Internet protocol version 4 (IPV4) traffic over the DNS protocol to circumvent firewalls,
13network security groups, and network access lists while evading detection.
14"""
15false_positives = [
16    """
17    Normal use of Iodine is uncommon apart from security testing and research. Use by non-security engineers is very
18    uncommon.
19    """,
20]
21from = "now-9m"
22index = ["auditbeat-*", "logs-endpoint.events.*", "endgame-*"]
23language = "kuery"
24license = "Elastic License v2"
25name = "Deprecated - Potential DNS Tunneling via Iodine"
26note = """This rule was deprecated due to its addition to the umbrella `Potential Linux Tunneling and/or Port Forwarding` (6ee947e9-de7e-4281-a55d-09289bdf947e) rule."""
27references = ["https://code.kryo.se/iodine/"]
28risk_score = 73
29rule_id = "041d4d41-9589-43e2-ba13-5680af75ebc2"
30severity = "high"
31tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Command and Control", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"]
32timestamp_override = "event.ingested"
33type = "query"
34query = '''
35event.category:process and host.os.type:linux and event.type:(start or process_started) and process.name:(iodine or iodined)
36'''
37
38[[rule.threat]]
39framework = "MITRE ATT&CK"
40
41[[rule.threat.technique]]
42id = "T1572"
43name = "Protocol Tunneling"
44reference = "https://attack.mitre.org/techniques/T1572/"
45
46[rule.threat.tactic]
47id = "TA0011"
48name = "Command and Control"
49reference = "https://attack.mitre.org/tactics/TA0011/"