Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊
Checking for a threefold increase or more in Full Name lookups per Client IP for the current day as compared to the daily average for the previous week. This can potentially identify excessive traffic to a given location that could be indicative of data transfer out of your network. This is only for Name lookups, so it would be recommended to review the firewall and web proxy logs in relation to the ClientIP making the interesting requests.
| Attribute | Value |
|---|---|
| Type | Hunting Query |
| Solution | Windows Server DNS |
| ID | 81b478a7-46e2-4f7f-a1aa-aba5e541232b |
| Tactics | CommandAndControl, Exfiltration |
| Techniques | T1568, T1008, T1048 |
| Required Connectors | DNS |
| Source | View on GitHub |
This content item queries data from the following tables:
| Table | Transformations | Ingestion API | Lake-Only |
|---|---|---|---|
DnsEvents |
✓ | ✗ | ? |
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊