AN1121
Analytic 1121
Windows
Detects high-frequency or anomalous DNS queries initiated by non-browser, non-system processes (e.g., PowerShell, rundll32, python.exe) used to establish command and control via DNS tunneling.
WinEventLog:Sysmon
EventCode=3, 22
NSM:Flow
dns.log
[QueryLengthThreshold]
Subdomain length for detecting base32/base64-encoded payloads
[ProcessImageFilter]
Flag non-standard executables making DNS queries
[TimeWindow]
Rate of queries in short interval per process
AN1122
Analytic 1122
Linux
Detects local daemons or scripts generating outbound DNS queries with long or frequent subdomains, indicative of DNS tunneling via tools like `iodine`, `dnscat2`, or `dig` from cronjobs or reverse shells.
auditd:SYSCALL
execve
NSM:Flow
dns.log
[SubdomainEntropyScore]
Detects encoded payloads or randomness in DNS labels
[DaemonAllowList]
Allowlisted system daemons expected to perform frequent lookups
AN1123
Analytic 1123
macOS
Detects scripting environments (AppleScript, osascript, curl) or non-native tools performing DNS queries with encoded subdomains, often used for data exfiltration or beaconing.
macos:unifiedlog
log stream 'eventMessage contains "dns_request"'
[EntropyThreshold]
Tunable threshold for randomness in subdomain labels
[UncommonProcessContext]
Filters on user-launched or cron-based queries
AN1124
Analytic 1124
Network Devices
Detects clients issuing DNS queries with high volume, long subdomain lengths, encoded payload patterns, or to known malicious infrastructure; indicative of DNS-based C2 channels.
NSM:Flow
dns.log
[DomainReputationFeed]
List of suspicious/malicious C2 domains
[QueryRatePerClient]
Tunable burst rate per IP per second
AN1125
Analytic 1125
ESXi
Detects unusual outbound DNS traffic from ESXi hosts, often from shell scripts, custom daemons, or malicious VIBs interacting with external DNS infrastructure outside the management plane.
esxi:syslog
/var/log/syslog.log
NSM:FLow
dns.log
[OutboundDNSVolume]
Threshold for data volume and frequency from ESXi IPs
[KnownGoodVIBs]
Baseline known packages for allowlist comparison