IMPORTANT: No additional bug fixes or documentation updates will be released for this version. For the latest information, see the current release documentation.
« AWS WAF Rule or Rule Group Deletion AdFind Command Activity »
Elastic Docs ›Elastic Security Solution [7.11] ›Detections and Alerts ›Prebuilt rule reference

Abnormally Large DNS Response

edit

Abnormally Large DNS Response

edit

Specially crafted DNS requests can manipulate a known overflow vulnerability in some Windows DNS servers which result in Remote Code Execution (RCE) or a Denial of Service (DoS) from crashing the service.

Rule type: query

Rule indices:

  • packetbeat-*
  • filebeat-*

Severity: medium

Risk score: 47

Runs every: 5 minutes

Searches indices from: now-6m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References:

Tags:

  • Elastic
  • Network
  • Threat Detection
  • Lateral Movement

Version: 2 (version history)

Added (Elastic Stack release): 7.10.0

Last modified (Elastic Stack release): 7.11.2

Rule authors: Elastic

Rule license: Elastic License

Potential false positives

edit

Environments that leverage DNS responses over 60k bytes will result in false positives - if this traffic is predictable and expected, it should be filtered out. Additionally, this detection rule could be triggered by an authorized vulnerability scan or compromise assessment.

Investigation guide

edit

Detection alerts from this rule indicate an attempt was made to exploit CVE-2020-1350 (SigRed) through the use of large DNS responses on a Windows DNS server. Here are some possible avenues of investigation:

  • Investigate any corresponding Intrusion Detection Signatures (IDS) alerts that can validate this detection alert.
  • Examine the dns.question_type network fieldset with a protocol analyzer, such as Zeek, Packetbeat, or Suricata, for SIG or RRSIG data.
  • Validate the patch level and OS of the targeted DNS server to validate the observed activity was not large-scale Internet vulnerability scanning.
  • Validate that the source of the network activity was not from an authorized vulnerability scan or compromise assessment.

Rule query

edit
event.category:(network or network_traffic) and destination.port:53
and (event.dataset:zeek.dns or type:dns or event.type:connection) and
network.bytes > 60000

Threat mapping

edit

Framework: MITRE ATT&CKTM

Rule version history

edit
Version 2 (7.11.2 release)
  • Formatting only
« AWS WAF Rule or Rule Group Deletion AdFind Command Activity »