Correlate DNS queries that generate domains with high entropy or gibberish patterns, combined with short-lived connections from unusual processes. Monitor Sysmon DNS events and Windows Security logs for abnormal query rates and failed lookups.
| Data Component | Name | Channel |
|---|---|---|
| Network Connection Creation (DC0082) | WinEventLog:Sysmon | EventCode=22 |
| Process Creation (DC0032) | WinEventLog:Security | EventCode=4688 |
| Field | Description |
|---|---|
| EntropyThreshold | Set threshold for randomness in queried domain strings (e.g., >4.0) |
| QueryFailureRate | Failed resolution ratio above normal baseline (e.g., >30%) |
| TimeWindow | Duration for aggregating suspicious DNS queries (e.g., 5–10 min) |
Identify processes issuing repeated DNS queries to random-looking domains with abnormal entropy or word concatenations. Correlate resolver logs with high NXDOMAIN rates and auditd socket connections.
| Data Component | Name | Channel |
|---|---|---|
| Network Traffic Flow (DC0078) | auditd:SYSCALL | socket/connect |
| Network Traffic Content (DC0085) | linux:syslog | Multiple NXDOMAIN responses and high entropy domains |
| Field | Description |
|---|---|
| NXDOMAINThreshold | Ratio of failed queries triggering alert (e.g., >40%) |
| DomainAge | Flag queries to domains registered in last 7–30 days |
Monitor unified DNS logs for abnormal domain queries with low lexical similarity to known domains, repeated failed lookups, and random string structures. Cross-check with process logs to confirm unusual origins (non-browser apps).
| Data Component | Name | Channel |
|---|---|---|
| Network Traffic Flow (DC0078) | macos:unifiedlog | High entropy domain queries with multiple NXDOMAINs |
| Process Creation (DC0032) | macos:unifiedlog | Unexpected apps performing repeated DNS lookups |
| Field | Description |
|---|---|
| ReputationFeedWhitelist | Exclude trusted CDN and cloud provider domains |
| LexicalScoreThreshold | Adjust score for word-based vs. letter-based DGAs |
Use ESXi syslogs to track abnormal DNS query patterns from management agents or VMs. Identify high-frequency, low-TTL, or unresolvable domains as suspicious. Correlate with unusual management plane process activity.
| Data Component | Name | Channel |
|---|---|---|
| Network Traffic Flow (DC0078) | esxi:syslog | Frequent DNS queries with high entropy names or NXDOMAIN results |
| Field | Description |
|---|---|
| ResolverConfigPaths | Expected resolver settings for ESXi hosts |
| DomainWhitelist | Trusted external domains for hypervisor operations |