Suspicious Named Error

calendar Aug 12, 2024 · attack.initial-access attack.t1190  ·
Share on: linkedin copy

Detects suspicious DNS error messages that indicate a fatal or suspicious error that could be caused by exploiting attempts

Sigma rule (View on GitHub)

 1title: Suspicious Named Error
 2id: c8e35e96-19ce-4f16-aeb6-fd5588dc5365
 3status: test
 4description: Detects suspicious DNS error messages that indicate a fatal or suspicious error that could be caused by exploiting attempts
 5references:
 6    - https://github.com/ossec/ossec-hids/blob/1ecffb1b884607cb12e619f9ab3c04f530801083/etc/rules/named_rules.xml
 7author: Florian Roth (Nextron Systems)
 8date: 2018-02-20
 9modified: 2022-10-05
10tags:
11    - attack.initial-access
12    - attack.t1190
13logsource:
14    product: linux
15    service: syslog
16detection:
17    keywords:
18        - ' dropping source port zero packet from '
19        - ' denied AXFR from '
20        - ' exiting (due to fatal error)'
21    condition: keywords
22falsepositives:
23    - Unknown
24level: high

References

Related rules

to-top