Generic DNS tunnel detected by Zeek
Set up the zeek integration.
このページは日本語には対応しておりません。随時翻訳に取り組んでいます。翻訳に関してご質問やご意見ございましたら、お気軽にご連絡ください。
Goal
Zeek generic DNS tunnel detected.
Strategy
This rule monitors Zeek logs for the generic DNS tunnel detector. The algorithm detects DNS tunnels without requiring use of signatures for every DNS tunneling tool. Since the algorithm measures information transfer, it is capable of detecting non-malicious tunnels that occur all the time. Attackers use DNS tunneling for command and control communications, as it is crucial to network operations and security monitoring visibility may be limited.
Triage and response
- Assess
{{@dns.question.name}} domain reputation to determine if domain has been noted as malicious by vendors. - Check for other signals from the originating device as a possible indication that the device has been compromised.
- If it is determined that the activity is malicious:
- Block the domain, if it aligns with organization incident response processes.
- Begin your organization’s incident response process and investigate.
