Anomalous volume of NXDomain DNS responses from a single source IP

This rule is part of a beta feature. To learn more, contact Support.

Classification:

attack

Tactic:

TA0011-command-and-control

Technique:

T1568-dynamic-resolution

Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel, n'hésitez pas à nous contacter.

Goal

Detects an anomalous volume of NXDOMAIN DNS responses returned to a single source IP.

Strategy

This rule monitors OCSF DNS Activity events where @ocsf.class_uid is 4003 and the response code @ocsf.rcode_id is 3 (NXDOMAIN), grouped by @ocsf.src_endpoint.ip. A spike of resolution failures from one host is a hallmark of domain generation algorithms (DGAs), where malware iterates through pseudo-random candidate domains until it reaches a live C2 endpoint.

Triage and response

  • Examine the hostnames queried by {{@ocsf.src_endpoint.ip}} and determine whether they share a DGA-like pattern (random character distribution, identical length, shared TLD).
  • Identify the process or workload on {{@ocsf.src_endpoint.ip}} driving the requests and verify it has a legitimate reason to be resolving the observed domains.
  • Determine if endpoint detection products on the host reported related execution, persistence, or beaconing activity around the same time.