DNS Amplification Attack — Open Resolver Abuse
06 DNS Amplification Open Resolver
Query
ASimDnsActivityLogs
| where TimeGenerated > ago(15m)
| where DnsQueryTypeName in~ ("ANY", "DNSKEY", "RRSIG")
or DnsQueryType in (255, 48, 46)
| summarize
AmpQueryCount = count(),
UniqueTargets = dcount(DnsQuery),
RecordTypes = make_set(DnsQueryTypeName),
FirstSeen = min(TimeGenerated),
LastSeen = max(TimeGenerated)
by SrcIpAddr, SrcHostname
| where AmpQueryCount > 500
| extend QueriesPerMinute = round(todouble(AmpQueryCount) / 15.0, 1)Explanation
This query is designed to detect potential DNS amplification attacks, which are a type of Distributed Denial of Service (DDoS) attack. Here's a simple breakdown of what the query does:
-
Purpose: It identifies patterns that are typical of DNS amplification attacks, where attackers send small DNS queries with a fake source IP address to open DNS resolvers. These resolvers then send large responses to the victim, amplifying the traffic significantly.
-
Detection Criteria:
- The query looks for DNS queries of types "ANY", "DNSKEY", and "RRSIG", which are known to generate large responses.
- It focuses on queries that have been made in the last 15 minutes.
- It counts the number of such queries from each source IP address and hostname.
- It flags any source that has made more than 500 of these queries in the 15-minute window.
-
Output:
- The query calculates the number of queries per minute.
- It provides details like the number of unique targets queried, the types of DNS records queried, and the time range of the queries.
-
Alerting:
- If the conditions are met, an alert is generated with details about the source of the potential attack, including the hostname, IP address, and the number of queries made.
- The alert includes a summary of the types of DNS records queried and the rate of queries per minute.
-
Severity and Status:
- The severity of this detection is marked as "Medium".
- The rule is currently available and active.
Overall, this query helps in identifying and alerting on potential DNS amplification attacks by monitoring for unusually high volumes of specific DNS queries that could indicate malicious activity.
Details
David Alonso
Released: July 28, 2026
Tables
Keywords
Operators
Severity
MediumTactics
MITRE Techniques
Frequency: 15m
Period: 15m