Detection rules › Kusto
Corelight - C2 DGA Detected Via Repetitive Failures
'Detects large amounts of DNS resolution failures.'
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Command & Control |
Rule body
id: 8eaa2268-74ee-492c-b869-450eff707fef
name: Corelight - C2 DGA Detected Via Repetitive Failures
description: |
'Detects large amounts of DNS resolution failures.'
severity: Medium
status: Available
requiredDataConnectors:
- connectorId: Corelight
dataTypes:
- Corelight_v2_dns
- Corelight_v2_dns_red
- corelight_dns
- corelight_dns_red
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
- CommandAndControl
relevantTechniques:
- T1568
query: |
let threshold = 25;
union corelight_dns, corelight_dns_red
// rcodes: SERVFAIL=2, NXDOMAIN=3
| where rcode in (2, 3)
| summarize count() by query, id_orig_h, bin(TimeGenerated, 5m)
| where count_ > threshold
entityMappings:
- entityType: IP
fieldMappings:
- identifier: Address
columnName: id_orig_h
version: 2.1.1
kind: Scheduled
Stages and Predicates
Stage 0: let
let threshold = 25;
Stage 1: union
union of 2 branches
Stage 2: source
corelight_dns
Stage 3: source
corelight_dns_red
Stage 4: where
where rcode in~ (2, 3)
Stage 5: summarize
summarize by query, id_orig_h
Stage 6: where
where count_ > 25
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
count_ | gt |
| field:"count_" kind:gt value:"25" |
rcode | in |
| field:"rcode" kind:in |
Output fields
These fields are emitted when the rule matches.
| Field | Source |
|---|---|
id_orig_h | summarize |
query | summarize |