AN1331
Analytic 1331
Windows
Identify repeated DNS resolutions where the same domain name returns multiple IPs in short succession, combined with low TTL values and high query volume from unusual processes. Correlate with process lineage (e.g., Office apps spawning abnormal DNS lookups).
WinEventLog:Sysmon
EventCode=3, 22
WinEventLog:Security
EventCode=1
[DNSQueryBurstThreshold]
Number of unique IPs returned per domain in a short window
[TimeWindow]
Adjust correlation timeframe for fast flux detection (e.g., 5–10 minutes)
AN1332
Analytic 1332
Linux
Monitor resolver logs and auditd events for domains resolving to a rotating set of IPs within very short TTL intervals. Correlate high query rates from non-browser applications (e.g., python, curl).
auditd:SYSCALL
socket/connect
[TTLThreshold]
Minimum TTL value considered suspicious (e.g., < 60 seconds)
[DomainReputationFeed]
External TI feed to exclude benign CDN or load balancer behavior
AN1333
Analytic 1333
macOS
Use unified logs to identify processes issuing repeated DNS queries where the resolved IP addresses change frequently within very short TTL values. Correlate with outbound network traffic to validate C2-like patterns.
macos:unifiedlog
Rapid domain-to-IP resolution changes for same domain
macos:unifiedlog
Unexpected apps generating frequent DNS queries
[DNSRotationRate]
Rate of IP churn per domain to trigger detection
[NewDomainThreshold]
Flag if domain was registered recently (e.g., < 30 days)
AN1334
Analytic 1334
ESXi
Monitor ESXi syslog and esxcli outputs for abnormal DNS resolver behavior, such as frequent domain-to-IP changes or unauthorized modifications of DNS settings used by management agents. Correlate domain lookups with short TTL values.
esxi:syslog
Frequent DNS resolution of same domain with rotating IPs
[ResolverConfigPaths]
Whitelist of expected DNS resolvers configured on ESXi
[ExternalDomainWhitelist]
Known trusted external domains for hypervisor services