AN1178
Analytic 1178
Windows
Correlate DNS queries that generate domains with high entropy or gibberish patterns, combined with short-lived connections from unusual processes. Monitor Sysmon DNS events and Windows Security logs for abnormal query rates and failed lookups.
WinEventLog:Sysmon
EventCode=3, 22
WinEventLog:Security
EventCode=4688
[EntropyThreshold]
Set threshold for randomness in queried domain strings (e.g., >4.0)
[QueryFailureRate]
Failed resolution ratio above normal baseline (e.g., >30%)
[TimeWindow]
Duration for aggregating suspicious DNS queries (e.g., 5–10 min)
AN1179
Analytic 1179
Linux
Identify processes issuing repeated DNS queries to random-looking domains with abnormal entropy or word concatenations. Correlate resolver logs with high NXDOMAIN rates and auditd socket connections.
auditd:SYSCALL
socket/connect
linux:syslog
Multiple NXDOMAIN responses and high entropy domains
[NXDOMAINThreshold]
Ratio of failed queries triggering alert (e.g., >40%)
[DomainAge]
Flag queries to domains registered in last 7–30 days
AN1180
Analytic 1180
macOS
Monitor unified DNS logs for abnormal domain queries with low lexical similarity to known domains, repeated failed lookups, and random string structures. Cross-check with process logs to confirm unusual origins (non-browser apps).
macos:unifiedlog
High entropy domain queries with multiple NXDOMAINs
macos:unifiedlog
Unexpected apps performing repeated DNS lookups
[ReputationFeedWhitelist]
Exclude trusted CDN and cloud provider domains
[LexicalScoreThreshold]
Adjust score for word-based vs. letter-based DGAs
AN1181
Analytic 1181
ESXi
Use ESXi syslogs to track abnormal DNS query patterns from management agents or VMs. Identify high-frequency, low-TTL, or unresolvable domains as suspicious. Correlate with unusual management plane process activity.
esxi:syslog
Frequent DNS queries with high entropy names or NXDOMAIN results
[ResolverConfigPaths]
Expected resolver settings for ESXi hosts
[DomainWhitelist]
Trusted external domains for hypervisor operations