Fast Flux DNS

// Fast Flux DNS Detection — Azure DNS Server Logs (DnsEvents)
// Detects domains resolving to an unusually high number of unique public IPs within a 1-hour window
let lookbackWindow = 1h;
let minUniqueIPThreshold = 5;
let minQueryCount = 3;
let KnownCDNDomains = dynamic([
  ".akamaiedge.net", ".akamaitechnologies.com", ".cloudfront.net",
  ".fastly.net", ".cloudflare.net", ".edgesuite.net",
  ".azureedge.net", ".trafficmanager.net", ".amazonaws.com",
  ".googleusercontent.com", ".gstatic.com"
]);
DnsEvents
| where TimeGenerated > ago(lookbackWindow)
| where SubType == "LookupQuery"
| where QueryType == "A" or QueryType == "AAAA"
| where ResultCode == 0
| where isnotempty(IPAddresses)
// Exclude known CDN domains by suffix
| where not(Name has_any (KnownCDNDomains))
// Exclude internal/trusted domains
| where not(Name matches regex @"\.(local|internal|corp|lan|home|arpa)$")
// Exclude Microsoft cloud services
| where not(Name endswith ".microsoft.com")
    and not(Name endswith ".windows.com")
    and not(Name endswith ".office.com")
    and not(Name endswith ".azure.com")
    and not(Name endswith ".live.com")
| mv-expand IPAddress = split(IPAddresses, ";")
| extend IPAddress = trim(" ", tostring(IPAddress))
| where isnotempty(IPAddress)
// Filter RFC1918 private and loopback addresses
| where not(IPAddress matches regex @"^(10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.|127\.|::1|0\.0\.0\.0)")
| summarize
    UniqueIPCount = dcount(IPAddress),
    IPAddressList = make_set(IPAddress, 100),
    QueryCount = count(),
    UniqueClients = dcount(ClientIP),
    ClientList = make_set(ClientIP, 20),
    FirstSeen = min(TimeGenerated),
    LastSeen = max(TimeGenerated)
    by Name
| where UniqueIPCount >= minUniqueIPThreshold
| where QueryCount >= minQueryCount
| extend ObservationMinutes = max_of(datetime_diff('minute', LastSeen, FirstSeen), 1)
| extend IPChurnRate = round(todouble(UniqueIPCount) / todouble(ObservationMinutes), 4)
| extend DomainParts = split(Name, ".")
| extend TLD = tostring(DomainParts[array_length(DomainParts) - 1])
| extend SLD = tostring(DomainParts[array_length(DomainParts) - 2])
| extend SuspiciousTLD = TLD in~ ("tk", "pw", "cc", "ws", "top", "xyz", "ru", "cn", "info", "online", "click", "link", "gq", "ml", "cf")
| extend ShortSLD = strlen(SLD) <= 8
| extend SuspicionScore = toint(SuspiciousTLD) + toint(ShortSLD) + iif(UniqueIPCount >= 10, 1, 0) + iif(UniqueClients >= 5, 1, 0)
| project
    DetectionTime = LastSeen,
    DomainName = Name,
    UniqueIPCount,
    IPChurnRate,
    QueryCount,
    UniqueClients,
    ClientList,
    IPAddressList,
    ObservationMinutes,
    TLD,
    SuspiciousTLD,
    ShortSLD,
    SuspicionScore,
    FirstSeen
| sort by UniqueIPCount desc, IPChurnRate desc

index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=22
| eval QueryName=lower(QueryName)
| where isnotnull(QueryName) AND QueryName!=""
| where NOT match(QueryName, "\.(local|internal|corp|lan|home|arpa)$")
| where NOT match(QueryName, "(microsoft\.com|windows\.com|office\.com|azure\.com|live\.com|windowsupdate\.com|msftconnecttest\.com|akamaiedge\.net|cloudfront\.net|fastly\.net|cloudflare\.net|azureedge\.net|trafficmanager\.net|amazonaws\.com)$")
| rex field=QueryResults max_match=50 "(?P<rawIP>[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3})"
| where isnotnull(rawIP)
| where NOT match(rawIP, "^(10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.|127\.0\.0\.0|0\.0\.0\.0)")
| bin _time span=1h
| stats
    dc(rawIP) as UniqueIPCount,
    values(rawIP) as IPAddresses,
    count as QueryCount,
    dc(host) as AffectedHosts,
    values(host) as HostList,
    values(Image) as ProcessList,
    earliest(_time) as FirstSeen,
    latest(_time) as LastSeen
    by _time, QueryName
| where UniqueIPCount >= 5
| where QueryCount >= 3
| eval TLD=mvindex(split(QueryName, "."), -1)
| eval SLD=mvindex(split(QueryName, "."), -2)
| eval SuspiciousTLD=if(match(TLD, "^(tk|pw|cc|ws|top|xyz|ru|cn|info|online|click|link|gq|ml|cf)$"), 1, 0)
| eval ShortSLD=if(len(SLD) <= 8, 1, 0)
| eval HighIPCount=if(UniqueIPCount >= 10, 1, 0)
| eval WideSpread=if(AffectedHosts >= 5, 1, 0)
| eval SuspicionScore=SuspiciousTLD + ShortSLD + HighIPCount + WideSpread
| table _time, QueryName, UniqueIPCount, QueryCount, AffectedHosts, HostList, ProcessList, IPAddresses, TLD, SuspiciousTLD, ShortSLD, SuspicionScore, FirstSeen, LastSeen
| sort - UniqueIPCount SuspicionScore

sequence by dns.question.name with maxspan=1h
  [dns where event.type == "answer" and
   dns.answers.type == "A" and
   not dns.question.name : ("*.akamaiedge.net","*.cloudflare.com","*.fastly.net",
                              "*.amazonaws.com","*.azure.com","*.cloudfront.net",
                              "*.akadns.net","*.edgesuite.net")]
  with runs=5

SELECT "DomainName" as Domain,
  COUNT(DISTINCT "AnswerIP") as UniqueIPs,
  COUNT(*) as QueryCount,
  MIN(DATEFORMAT(devicetime, 'yyyy-MM-dd HH:mm:ss')) as FirstSeen,
  MAX(DATEFORMAT(devicetime, 'yyyy-MM-dd HH:mm:ss')) as LastSeen,
  CASE WHEN COUNT(DISTINCT "AnswerIP") >= 20 THEN 10
       WHEN COUNT(DISTINCT "AnswerIP") >= 10 THEN 7
       WHEN COUNT(DISTINCT "AnswerIP") >= 5 THEN 5
       ELSE 3 END as RiskScore
FROM events
WHERE category = 'dns'
  AND "RecordType" IN ('A','AAAA')
  AND devicetime > NOW() - 3600000
  AND "DomainName" NOT ILIKE ANY ('%.akamaiedge.net%','%.cloudflare.com%','%.fastly.net%',
                                    '%.amazonaws.com%','%.azure.com%','%.cloudfront.net%')
GROUP BY "DomainName", FLOOR(devicetime/3600000)
HAVING COUNT(DISTINCT "AnswerIP") >= 5 AND COUNT(*) >= 3
ORDER BY UniqueIPs DESC

_sourceCategory=dns/logs
| json auto
| where RecordType in ("A","AAAA")
| where !Domain matches ".*(akamaiedge|cloudflare|fastly|amazonaws|azure|cloudfront|akadns|edgesuite).*"
| timeslice 1h
| stats dc(AnswerIP) as UniqueIPs, count() as QueryCount, values(AnswerIP) as IPList
        by Domain, _timeslice
| where UniqueIPs >= 5 AND QueryCount >= 3
| eval risk = if(UniqueIPs >= 20, "critical", if(UniqueIPs >= 10, "high", "medium"))
| sort by UniqueIPs desc

rule fast_flux_dns {
  meta:
    author = "Detection Engineering"
    description = "Detects fast flux DNS behavior with high IP rotation (T1568.001)"
    severity = "HIGH"
    tactic = "TA0011"

  events:
    $e.metadata.event_type = "NETWORK_DNS"
    $e.network.dns.answers.type = "A"
    not re.regex($e.network.dns.questions.name, `(?i)(akamaiedge|cloudflare|fastly|amazonaws|azure|cloudfront|akadns)`) nocase
    $domain = $e.network.dns.questions.name
    $ip = $e.network.dns.answers.data

  match:
    $domain over 1h

  outcome:
    $unique_ips = count_distinct($ip)

  condition:
    $unique_ips >= 5
}

#event_simpleName = "DnsRequest"
| DomainName != /(akamaiedge|cloudflare|fastly|amazonaws|azure|cloudfront|akadns)/i
| stats dc(IP) as UniqueIPs, count() as QueryCount, values(IP) as IPList by DomainName, span(timestamp, 1h)
| where UniqueIPs >= 5 AND QueryCount >= 3
| eval risk = if(UniqueIPs >= 20, "critical", if(UniqueIPs >= 10, "high", "medium"))
| table timestamp, DomainName, UniqueIPs, QueryCount, IPList, risk
| sort by UniqueIPs desc