Abnormally Large DNS Response

 1[metadata]
 2creation_date = "2020/07/16"
 3integration = ["network_traffic"]
 4maturity = "production"
 5min_stack_comments = "New fields added: required_fields, related_integrations, setup"
 6min_stack_version = "8.3.0"
 7updated_date = "2023/08/01"
 8
 9[rule]
10author = ["Elastic"]
11description = """
12Specially crafted DNS requests can manipulate a known overflow vulnerability in some Windows DNS servers, resulting in
13Remote Code Execution (RCE) or a Denial of Service (DoS) from crashing the service.
14"""
15false_positives = [
16    """
17    Environments that leverage DNS responses over 60k bytes will result in false positives - if this traffic is
18    predictable and expected, it should be filtered out. Additionally, this detection rule could be triggered by an
19    authorized vulnerability scan or compromise assessment.
20    """,
21]
22index = ["packetbeat-*", "filebeat-*", "logs-network_traffic.*"]
23language = "kuery"
24license = "Elastic License v2"
25name = "Abnormally Large DNS Response"
26note = """## Triage and analysis
27
28### Investigating Abnormally Large DNS Response
29
30Detection alerts from this rule indicate possible anomalous activity around large byte DNS responses from a Windows DNS server. This detection rule was created based on activity represented in exploitation of vulnerability (CVE-2020-1350) also known as [SigRed](https://www.elastic.co/blog/detection-rules-for-sigred-vulnerability) during July 2020.
31
32#### Possible investigation steps
33
34- This specific rule is sourced from network log activity such as DNS or network level data. It's important to validate the source of the incoming traffic and determine if this activity has been observed previously within an environment.
35- Activity can be further investigated and validated by reviewing any associated Intrusion Detection Signatures (IDS) alerts.
36- Further examination can include a review of the `dns.question_type` network fieldset with a protocol analyzer, such as Zeek, Packetbeat, or Suricata, for `SIG` or `RRSIG` data.
37- Validate the patch level and OS of the targeted DNS server to validate the observed activity was not large-scale internet vulnerability scanning.
38- Validate that the source of the network activity was not from an authorized vulnerability scan or compromise assessment.
39
40#### False positive analysis
41
42- Based on this rule, which looks for a threshold of 60k bytes, it is possible for activity to be generated under 65k bytes and related to legitimate behavior. In packet capture files received by the [SANS Internet Storm Center](https://isc.sans.edu/forums/diary/PATCH+NOW+SIGRed+CVE20201350+Microsoft+DNS+Server+Vulnerability/26356/), byte responses were all observed as greater than 65k bytes.
43- This activity can be triggered by compliance/vulnerability scanning or compromise assessment; it's important to determine the source of the activity and potentially allowlist the source host.
44
45### Related rules
46
47- Unusual Child Process of dns.exe - 8c37dc0e-e3ac-4c97-8aa0-cf6a9122de45
48- Unusual File Modification by dns.exe - c7ce36c0-32ff-4f9a-bfc2-dcb242bf99f9
49
50### Response and remediation
51
52- Initiate the incident response process based on the outcome of the triage.
53- Ensure that you have deployed the latest Microsoft [Security Update](https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1350) (Monthly Rollup or Security Only) and restarted the patched machines. If unable to patch immediately, Microsoft [released](https://support.microsoft.com/en-us/help/4569509/windows-dns-server-remote-code-execution-vulnerability) a registry-based workaround that doesn’t require a restart. This can be used as a temporary solution before the patch is applied.
54- Maintain backups of your critical systems to aid in quick recovery.
55- Perform routine vulnerability scans of your systems, monitor [CISA advisories](https://us-cert.cisa.gov/ncas/current-activity) and patch identified vulnerabilities.
56- If you observe a true positive, implement a remediation plan and monitor host-based artifacts for additional post-exploitation behavior.
57"""
58references = [
59    "https://research.checkpoint.com/2020/resolving-your-way-into-domain-admin-exploiting-a-17-year-old-bug-in-windows-dns-servers/",
60    "https://msrc-blog.microsoft.com/2020/07/14/july-2020-security-update-cve-2020-1350-vulnerability-in-windows-domain-name-system-dns-server/",
61    "https://github.com/maxpl0it/CVE-2020-1350-DoS",
62    "https://www.elastic.co/security-labs/detection-rules-for-sigred-vulnerability",
63]
64risk_score = 47
65rule_id = "11013227-0301-4a8c-b150-4db924484475"
66severity = "medium"
67tags = [
68    "Use Case: Threat Detection",
69    "Tactic: Lateral Movement",
70    "Resources: Investigation Guide",
71    "Use Case: Vulnerability",
72]
73timestamp_override = "event.ingested"
74type = "query"
75
76query = '''
77(event.dataset: network_traffic.dns or (event.category: (network or network_traffic) and destination.port: 53)) and
78  (event.dataset:zeek.dns or type:dns or event.type:connection) and network.bytes > 60000
79'''
80
81
82[[rule.threat]]
83framework = "MITRE ATT&CK"
84[[rule.threat.technique]]
85id = "T1210"
86name = "Exploitation of Remote Services"
87reference = "https://attack.mitre.org/techniques/T1210/"
88
89
90[rule.threat.tactic]
91id = "TA0008"
92name = "Lateral Movement"
93reference = "https://attack.mitre.org/tactics/TA0008/"