Datazag - retro-hunt historical DNS against impersonation indicators

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Content Index

---

Matches Datazag impersonation indicators against historical ASIM-normalized DNS to surface domains resolved inside the estate before the feed was connected. Adjust dns_lookback to your DNS retention. Requires ASIM DNS parsers.

Attribute	Value
Type	Hunting Query
Solution	Datazag
ID	2d7b90c5-41ae-4f83-a6d2-9b1c5e3407fa
Kind	Hunting
Tactics	InitialAccess, CommandAndControl
Techniques	T1566, T1071
Required Connectors	ThreatIntelligenceTaxii
Source	View on GitHub

Tables Used

This content item queries data from the following tables:

Table	Selection Criteria	Transformations	Ingestion API	Lake-Only
ThreatIntelIndicators		✓	✓	✗

---

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Hunting Queries · Back to Datazag