Detect DNS in Splunk

| multisearch
[
  search index=dns sourcetype="stream:dns" (query_type="AXFR" OR query_type="IXFR" OR query_type="255")
  NOT (src_ip="10.*" OR src_ip="192.168.*" OR src_ip="172.16.*" OR src_ip="172.17.*" OR src_ip="172.18.*" OR src_ip="172.19.*" OR src_ip="172.20.*" OR src_ip="172.21.*" OR src_ip="172.22.*" OR src_ip="172.23.*" OR src_ip="172.24.*" OR src_ip="172.25.*" OR src_ip="172.26.*" OR src_ip="172.27.*" OR src_ip="172.28.*" OR src_ip="172.29.*" OR src_ip="172.30.*" OR src_ip="172.31.*" OR src_ip="127.*")
  | eval AlertType="External Zone Transfer Attempt", RiskScore=90
  | eval src=src_ip, dest=dest_ip, query_name=query, qtype=query_type
]
[
  search index=dns sourcetype="stream:dns" (query_type="NS" OR query_type="MX" OR query_type="TXT" OR query_type="SOA" OR query_type="255" OR query_type="ANY")
  NOT (src_ip="10.*" OR src_ip="192.168.*" OR src_ip="172.*" OR src_ip="127.*")
  | eval AlertType="Bulk External DNS Enumeration", RiskScore=70
  | eval src=src_ip, dest=dest_ip, query_name=query, qtype=query_type
  | bucket _time span=10m
  | stats count as QueryCount, dc(query) as UniqueNames, values(query_type) as QueryTypes by src, dest, _time, AlertType, RiskScore
  | where QueryCount > 30 OR UniqueNames > 20
]
[
  search index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
  (Image="*\\dnsrecon*" OR Image="*\\dnsx*" OR Image="*\\subfinder*" OR Image="*\\amass*"
  OR Image="*\\fierce*" OR Image="*\\dnsmap*" OR Image="*\\dnsenum*" OR Image="*\\gobuster*"
  OR Image="*\\altdns*" OR Image="*\\knockpy*"
  OR ((Image="*\\python*" OR Image="*\\python3*") AND (CommandLine="*dnsrecon*" OR CommandLine="*dnsenum*" OR CommandLine="*fierce*" OR CommandLine="*sublist3r*" OR CommandLine="*dnstwist*"))
  OR (Image="*\\nslookup.exe" AND (CommandLine="*-type=axfr*" OR CommandLine="*-q=axfr*" OR CommandLine="*-querytype=axfr*" OR CommandLine="*-type=any*" OR CommandLine="*ls -d*" OR CommandLine="*ls -t*"))
  OR (Image="*\\dig*" AND (CommandLine="*axfr*" OR CommandLine="*AXFR*" OR CommandLine="* any *" OR CommandLine="*_dmarc*" OR CommandLine="* MX *" OR CommandLine="* NS *")))
  | eval AlertType="DNS Enumeration Tool on Endpoint", RiskScore=60
  | eval src=host, query_name=CommandLine
]
| eval log_source=coalesce(sourcetype, "unknown")
| table _time, AlertType, RiskScore, src, dest, query_name, qtype, QueryCount, UniqueNames, host, User, Image, CommandLine, ParentImage
| sort - RiskScore, - _time