High TXT Records Requests Rate

calendar Apr 21, 2023 · attack.exfiltration attack.t1048.003 attack.command_and_control attack.t1071.004  ·
Share on: linkedin copy

Extremely high rate of TXT record type DNS requests from host per short period of time. Possible result of Do-exfiltration tool execution

Sigma rule (View on GitHub)

 1title: High TXT Records Requests Rate
 2id: f0a8cedc-1d22-4453-9c44-8d9f4ebd5d35
 3status: unsupported
 4description: Extremely high rate of TXT record type DNS requests from host per short period of time. Possible result of Do-exfiltration tool execution
 5author: Daniil Yugoslavskiy, oscd.community
 6date: 2019/10/24
 7modified: 2023/03/24
 8tags:
 9    - attack.exfiltration
10    - attack.t1048.003
11    - attack.command_and_control
12    - attack.t1071.004
13logsource:
14    category: dns
15detection:
16    selection:
17        record_type: 'TXT'
18    timeframe: 1m
19    condition: selection | count() by src_ip > 50
20falsepositives:
21    - Legitimate high DNS TXT requests rate to domain name which should be added to whitelist
22level: medium

Related rules

to-top