High DNS Bytes Out - Firewall

calendar Apr 21, 2023 · attack.exfiltration attack.t1048.003  ·
Share on: linkedin copy

High DNS queries bytes amount from host per short period of time

Sigma rule (View on GitHub)

 1title: High DNS Bytes Out - Firewall
 2id: 3b6e327d-8649-4102-993f-d25786481589
 3status: unsupported
 4description: High DNS queries bytes amount from host per short period of time
 5author: Daniil Yugoslavskiy, oscd.community
 6date: 2019/10/24
 7modified: 2023/03/24
 8tags:
 9    - attack.exfiltration
10    - attack.t1048.003
11logsource:
12    category: firewall
13detection:
14    selection:
15        dst_port: 53
16    timeframe: 1m
17    condition: selection | sum(message_size) by src_ip > 300000
18falsepositives:
19    - Legitimate high DNS bytes out rate to domain name which should be added to whitelist
20level: medium

Related rules

to-top