KQL Search

This query is designed to detect potential DNS tunneling activity by monitoring for an unusually high number of DNS TXT record queries from a client within a one-hour period. DNS tunneling is a technique used by attackers to send data through DNS queries, often for command and control (C2) communication or data exfiltration.

Key Points:

• Purpose: Identify clients making a large number of TXT record DNS queries, which can indicate the use of DNS tunneling tools like iodine, dnscat2, or Cobalt Strike.
• Focus: Specifically targets TXT records, which can carry up to 255 characters and are often used to encode commands or data.
• Detection Criteria:
  • Looks for clients that have made more than 250 TXT queries to over 20 unique domains in the past hour.
• Data Source: Uses logs from the ASimDnsActivityLogs data type, which is connected through the WindowsDnsAma connector.
• Alert Details:
  • Generates an alert if the criteria are met, providing details such as the number of TXT queries, the number of unique domains queried, and sample domain names.
  • The alert includes the hostname or IP address of the client and a summary of the activity.
• Severity: Classified as a high-severity alert due to the potential for malicious activity.
• Tactics and Techniques: Related to command and control (T1071.004) and data exfiltration (T1048.003) tactics.

This query is a specialized rule that complements existing general DNS tunneling detection by focusing specifically on TXT records, which are commonly used in DNS tunneling attacks.