network | Detection.FYI

High DNS Bytes Out

Apr 21, 2023 · attack.exfiltration attack.t1048.003 ·
Share on:

High DNS queries bytes amount from host per short period of time

Read More
High DNS Bytes Out - Firewall

Apr 21, 2023 · attack.exfiltration attack.t1048.003 ·
Share on:

High DNS queries bytes amount from host per short period of time

Read More
High DNS Requests Rate

Apr 21, 2023 · attack.exfiltration attack.t1048.003 attack.command_and_control attack.t1071.004 ·
Share on:

High DNS requests amount from host per short period of time

Read More
High DNS Requests Rate - Firewall

Apr 21, 2023 · attack.exfiltration attack.t1048.003 attack.command_and_control attack.t1071.004 ·
Share on:

High DNS requests amount from host per short period of time

Read More
High NULL Records Requests Rate

Apr 21, 2023 · attack.exfiltration attack.t1048.003 attack.command_and_control attack.t1071.004 ·
Share on:

Extremely high rate of NULL record type DNS requests from host per short period of time. Possible result of iodine tool execution

Read More
High TXT Records Requests Rate

Apr 21, 2023 · attack.exfiltration attack.t1048.003 attack.command_and_control attack.t1071.004 ·
Share on:

Extremely high rate of TXT record type DNS requests from host per short period of time. Possible result of Do-exfiltration tool execution

Read More
Large domain name request

Apr 21, 2023 · attack.exfiltration attack.t1048 ·
Share on:

Detects large DNS domain names

Read More
Network Scans Count By Destination IP

Apr 21, 2023 · attack.discovery attack.t1046 ·
Share on:

Detects many failed connection attempts to different ports or hosts

Read More
Network Scans Count By Destination Port

Apr 21, 2023 · attack.discovery attack.t1046 ·
Share on:

Detects many failed connection attempts to different ports or hosts

Read More
Possible DNS Rebinding

Apr 21, 2023 · attack.command_and_control attack.t1043 ·
Share on:

Detects DNS-answer with TTL <10.

Read More
Possible DNS Tunneling

Apr 21, 2023 · attack.command_and_control attack.t1071.004 attack.exfiltration attack.t1048.003 ·
Share on:

Normally, DNS logs contain a limited amount of different dns queries for a single domain. This rule detects a high amount of queries for a single domain, which can be an indicator that DNS is used to transfer data.

Read More