Excessive Usage of NSLOOKUP App

name: Excessive Usage of NSLOOKUP App
id: 0a69fdaa-a2b8-11eb-b16d-acde48001122
version: 13
creation_date: '2021-04-22'
modification_date: '2026-08-24'
author: Teoderick Contreras, Stanislav Miskovic, Splunk
status: production
type: Anomaly
description: The following analytic detects excessive usage of the nslookup application, which may indicate potential DNS exfiltration attempts. It leverages Sysmon EventCode 1 to monitor process executions, specifically focusing on nslookup.exe. The detection identifies outliers by comparing the frequency of nslookup executions against a calculated threshold. This activity is significant as it can reveal attempts by malware or APT groups to exfiltrate data via DNS queries. If confirmed malicious,this behavior could allow attackers to stealthily transfer sensitive information out of the network, bypassing traditional data exfiltration defenses.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count as numNsLookup min(_time) as firstTime max(_time) as lastTime values(Processes.action) as action values(Processes.original_file_name) as original_file_name values(Processes.parent_process_exec) as parent_process_exec values(Processes.parent_process_guid) as parent_process_guid values(Processes.parent_process_name) as parent_process_name values(Processes.parent_process_path) as parent_process_path values(Processes.process) as process values(Processes.process_exec) as process_exec values(Processes.process_guid) as process_guid values(Processes.process_hash) as process_hash values(Processes.process_id) as process_id values(Processes.process_integrity_level) as process_integrity_level values(Processes.process_path) as process_path values(Processes.user_id) as user_id values(Processes.vendor_product) as vendor_product values(Processes.parent_process) as parent_process values(Processes.process_name) as process_name values(Processes.parent_process_id) as parent_process_id values(Processes.user) as user FROM datamodel=Endpoint.Processes
      WHERE Processes.process_name = "nslookup.exe"
      BY Processes.dest _time span=1m
    | `drop_dm_object_name(Processes)`
    | eventstats avg(numNsLookup) as avgNsLookup, stdev(numNsLookup) as stdNsLookup, count as numSlots
      BY dest
    | eval upperThreshold=(avgNsLookup + stdNsLookup *3)
    | eval isOutlier=if(numNsLookup > 20 and numNsLookup >= upperThreshold, 1, 0)
    | search isOutlier=1
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `excessive_usage_of_nslookup_app_filter`
how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances of nslookup.exe may be used.
known_false_positives: Network or DNS monitoring tools that perform bulk nslookup checks against multiple domains in quick succession (e.g., CDN health checks, load balancer DNS validation scripts) may exceed the detection threshold as part of normal, scheduled operation. Hosts with limited historical baseline data may also cross the dynamic threshold more easily due to low computed average and standard deviation values. Tune the detection or add exceptions for known monitoring tool parent processes as needed.
references:
    - https://www.mandiant.com/resources/fin7-spear-phishing-campaign-targets-personnel-involved-sec-filings
    - https://www.varonis.com/blog/dns-tunneling
    - https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: Excessive usage of nslookup.exe has been detected on $dest$. This detection is triggered as as it violates the dynamic threshold
analytic_story:
    - Suspicious DNS Traffic
    - Dynamic DNS
    - Data Exfiltration
    - Command And Control
asset_type: Endpoint
mitre_attack_id:
    - T1048
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint