Diamond Sleet APT DNS Communication Indicators

 1title: Diamond Sleet APT DNS Communication Indicators
 2id: fba38e0f-4607-4344-bb8f-a4b50cdeef7f
 3status: experimental
 4description: Detects DNS queries related to Diamond Sleet APT activity
 5references:
 6    - https://www.microsoft.com/en-us/security/blog/2023/10/18/multiple-north-korean-threat-actors-exploiting-the-teamcity-cve-2023-42793-vulnerability/
 7author: Nasreddine Bencherchali (Nextron Systems)
 8date: 2023/10/24
 9tags:
10    - attack.command_and_control
11    - detection.emerging_threats
12logsource:
13    product: windows
14    category: dns_query
15detection:
16    selection:
17        QueryName|contains:
18            - '3dkit.org'
19            - 'dersmarketim.com'
20            - 'galerielamy.com'
21            - 'olidhealth.com'
22    condition: selection
23falsepositives:
24    - Might generate some false positive if triggered by a user during investigation for example.
25level: high