AN0109
Analytic 0109
Windows
Correlate high-frequency or anomalous DNS query activity with processes that do not normally generate network requests (e.g., Office apps, system utilities). Detect pseudo-random or high-entropy domain lookups indicative of domain generation algorithms (DGAs).
WinEventLog:Sysmon
EventCode=3, 22
WinEventLog:Sysmon
EventCode=1
[EntropyThreshold]
Adjust based on environment to differentiate DGAs from legitimate CDNs
[TimeWindow]
Interval for correlating bursts of DNS queries from the same process
AN0110
Analytic 0110
Linux
Monitor /var/log/audit/audit.log and DNS resolver logs for repeated failed lookups or connections to high-entropy domain names. Correlate suspicious DNS queries with process lineage (e.g., Python, bash, or unusual system daemons).
auditd:SYSCALL
socket/connect
linux:syslog
Query to suspicious domain with high entropy or low reputation
[DomainReputationFeed]
Whitelist/blacklist tuned with external threat intel sources
[ProcessWhitelist]
Known safe daemons that frequently query domains
AN0111
Analytic 0111
macOS
Inspect unified logs for anomalous DNS resolutions triggered by non-network applications. Flag repeated connections to newly registered or algorithmically generated domains. Correlate with endpoint process telemetry.
macos:unifiedlog
DNS query with pseudo-random subdomain patterns
macos:unifiedlog
Unexpected applications generating outbound DNS queries
[NewDomainThreshold]
Age of domain registration considered suspicious (e.g., < 30 days)
[DNSQueryVolume]
Number of queries per process per time window
AN0112
Analytic 0112
ESXi
Monitor esxcli and syslog records for DNS resolver changes or repeated queries to unusual external domains by management agents. Detect unauthorized changes to VM or host network settings that redirect DNS lookups.
esxi:syslog
esxcli network vswitch or DNS resolver configuration updates
[ResolverConfigPaths]
Expected resolvers or DNS forwarders in ESXi configurations
[ExternalDomainWhitelist]
Set of trusted external domains expected for ESXi host activity