ISC BIND named TKEY Query Remote Denial of Service (CVE-2015-5477)

let tkeyQueries = DnsEvents
| where TimeGenerated > ago(1h)
| where QueryType =~ "TKEY" or QueryType == "249"
| summarize TkeyCount = count(), ClientIPs = make_set(ClientIP, 50) by bin(TimeGenerated, 5m), Computer;
let namedCrashes = Syslog
| where TimeGenerated > ago(1h)
| where ProcessName =~ "named"
| where SyslogMessage has_any ("REQUIRE", "assertion failure", "buffer.c", "RUNTIME_CHECK", "exiting (due to fatal error)")
| summarize CrashCount = count(), Msgs = make_set(SyslogMessage, 20) by bin(TimeGenerated, 5m), Computer;
tkeyQueries
| join kind=leftouter namedCrashes on Computer, $left.TimeGenerated == $right.TimeGenerated
| extend Suspicious = (TkeyCount > 0 and CrashCount > 0)
| project TimeGenerated, Computer, TkeyCount, ClientIPs, CrashCount, Msgs, Suspicious
| where TkeyCount > 0

(index=dns sourcetype="isc:bind:query" (query_type="TKEY" OR query_type="249" OR record_type="TKEY"))
| bin _time span=5m
| stats count AS tkey_count values(src_ip) AS src_ips by _time, host
| join type=left _time, host
    [ search (index=os sourcetype="syslog" process="named" ("REQUIRE" OR "assertion failure" OR "buffer.c" OR "RUNTIME_CHECK" OR "exiting (due to fatal error)"))
    | bin _time span=5m
    | stats count AS crash_count values(_raw) AS crash_msgs by _time, host ]
| eval suspicious=if(tkey_count>0 AND crash_count>0, "yes", "no")
| where tkey_count>0
| table _time host tkey_count src_ips crash_count crash_msgs suspicious

sequence by host.name with maxspan=5m
  [ network where dns.question.type == "TKEY" or dns.question.type == "249" ]
  [ process where process.name == "named" and event.action in ("end", "process_stopped") ]

SELECT QIDNAME(qid) AS event, sourceip, destinationip, "DNS Query Type" AS qtype, DATEFORMAT(starttime,'yyyy-MM-dd HH:mm:ss') AS time
FROM events
WHERE (LOGSOURCETYPENAME(devicetype) ILIKE '%DNS%' OR "Process Name" = 'named')
  AND ( "DNS Query Type" = '249' OR "DNS Query Type" ILIKE 'TKEY'
        OR UTF8(payload) ILIKE '%assertion failure%'
        OR UTF8(payload) ILIKE '%RUNTIME_CHECK%buffer.c%' )
  AND starttime > NOW() - 1 HOURS
ORDER BY starttime DESC

(_sourceCategory=*dns* OR _sourceCategory=*bind*)
| where (query_type = "TKEY" or query_type = "249" or _raw matches "*assertion failure*" or _raw matches "*RUNTIME_CHECK*buffer.c*" or _raw matches "*exiting (due to fatal error)*")
| if (_raw matches "*assertion*" or _raw matches "*RUNTIME_CHECK*", 1, 0) as is_crash
| if (query_type = "TKEY" or query_type = "249", 1, 0) as is_tkey
| timeslice 5m
| sum(is_tkey) as tkey_count, sum(is_crash) as crash_count by _timeslice, host
| where tkey_count > 0

rule cve_2015_5477_bind_tkey_dos {
  meta:
    author = "Argus Detection Platform"
    description = "ISC BIND TKEY query remote DoS (CVE-2015-5477)"
    severity = "CRITICAL"
  events:
    $dns.metadata.event_type = "NETWORK_DNS"
    ($dns.network.dns.questions.type = 249 or $dns.network.dns.questions.type = "TKEY")
    $dns.principal.hostname = $host
    $proc.metadata.event_type = "PROCESS_TERMINATION"
    $proc.target.process.file.full_path = /named/ nocase
    $proc.principal.hostname = $host
  match:
    $host over 5m
  condition:
    $dns and $proc
}

#event_simpleName=/Dns|Network/ 
| (DnsRequestType=249 OR DnsRequestType="TKEY" OR DomainName=/tkey/i)
| join({#event_simpleName=ProcessRollup2 OR #event_simpleName=EndOfProcess ImageFileName=/named$/i}, field=[aid], include=[ImageFileName, ProcessEndTime], mode=left)
| groupBy([aid, ComputerName], function=[count(as=tkey_count), collect([DomainName, ImageFileName])])
| tkey_count > 0