FortiSIEM Rules

Windows DNS Server: Suspicious DNS Traffic Resolved

Rule ID

PH_RULE_WinDNSServer_SuspDNSTrafficResolved

Default Status

Enabled

Description

This rule detects that the response from DNS server to original DNS client, the destination IP is the originating client that made the DNS resolution request.

Severity

9

Category

Security

MITRE ATT&CK® Tactics

Behavioral Anomaly

MITRE ATT&CK® Techniques

No Technique Specified

Impacts

Network

Data Source

Windows DNS (with debug log enabled) via FortiSIEM Agent

Detection

Correlation

Remediation Guidance

Confirm if the lookup is intended or not. Determine application or business use of the domain, and block if necessary. info and some other TLDs are uncommon in business cases, and should be looked at with caution.

Time Window

If the following pattern or patterns match an ingested event within the given time window in seconds, trigger an incident.

300 seconds

Trigger Conditions

If the following defined pattern/s occur within a 300 second time window.

suspicious_dns

SubPattern Definitions

SubPattern Name: suspicious_dns

This is the named definition of the event query, this is important if multiple subpatterns are defined to distinguish them.

SubPattern Query

This is the query logic that matches incoming events

eventType CONTAIN "AO-WUA-DNS"  AND  eventAction = 0  AND  type = "Response"  AND  direction = "Snd"  AND ( dnsQueryName REGEXP "^.*\.info$"  OR  dnsQueryName IN (Group@PH_SYS_FORTIGUARD_MAL_DOMAIN) )

Group by Attributes

This defines how matching events are aggregated, only events with the same matching attribute values are grouped into one unique incident ID

destIpAddr,dnsQueryName

Aggregate Constraint

This is most typically a numerical constraint that defines when the rule should trigger an incident

COUNT(*) >= 1

Incident Attribute Mapping

This section defines which fields in matching raw events should be mapped to the incident attributes in the resulting incident.

The available raw event attributes to map are limited to the group by attributes and the aggregate event constraint fields for each subpattern

 destIpAddr=suspicious_dns.destIpAddr,
dnsQueryName=suspicious_dns.dnsQueryName