Data Exfiltration via DNS Tunneling Tools

let LookbackWindow = 24h;
let MinQueriesPerApex = 50; // Tunneling tools issue dozens-to-hundreds of queries per file
let MinLabelLen = 20; // encoded chunks are long, unlike normal hostnames
let MinAvgLabelLen = 28; // tunneling tools pack labels close to the 63-byte DNS label ceiling to maximize payload-per-query
DeviceDnsEvents
| where Timestamp > ago(LookbackWindow)
| where isnotempty(QueryName)
// NOTE: DeviceDnsEvents has no record-type (A/TXT/NULL) column, so this model
// relies on volume, label cardinality, and label-length skew only.
| extend Labels = split(QueryName, ".")
| extend FirstLabel = tostring(Labels[0])
| extend FirstLabelLen = strlen(FirstLabel)
| extend ApexDomain = strcat(tostring(Labels[array_length(Labels) - 2]), ".", tostring(Labels[array_length(Labels) - 1]))
| where FirstLabelLen >= MinLabelLen
| summarize
    QueryCount = count(),
    UniqueLabels = dcount(FirstLabel),
    AvgLabelLen = avg(FirstLabelLen),
    MaxLabelLen = max(FirstLabelLen),
    SampleLabels = make_set(FirstLabel, 5),
    FirstSeen = min(Timestamp),
    LastSeen = max(Timestamp)
    by DeviceName, AccountName, InitiatingProcessFileName, ApexDomain
| extend IsHighVolume = QueryCount >= MinQueriesPerApex
| extend IsHighCardinality = UniqueLabels >= (MinQueriesPerApex * 0.8) // near-1:1 label:query ratio == data-bearing, not caching
| extend IsLongLabelSkewed = AvgLabelLen >= MinAvgLabelLen
| extend TunnelScore = tolong(IsHighVolume) + tolong(IsHighCardinality) + tolong(IsLongLabelSkewed)
| where TunnelScore >= 2
| project FirstSeen, LastSeen, DeviceName, AccountName, InitiatingProcessFileName,
    ApexDomain, QueryCount, UniqueLabels, AvgLabelLen, MaxLabelLen,
    SampleLabels, TunnelScore
| sort by TunnelScore desc, QueryCount desc

index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=22
| eval Labels=split(QueryName, ".")
| eval FirstLabel=mvindex(Labels, 0)
| eval FirstLabelLen=len(FirstLabel)
| eval LabelCount=mvcount(Labels)
| eval ApexDomain=mvindex(Labels, LabelCount-2) . "." . mvindex(Labels, LabelCount-1)
| where FirstLabelLen >= 20
| stats
    count as QueryCount,
    dc(FirstLabel) as UniqueLabels,
    avg(FirstLabelLen) as AvgLabelLen,
    max(FirstLabelLen) as MaxLabelLen,
    values(FirstLabel) as SampleLabels
    by host, User, Image, ApexDomain
| eval IsHighVolume=if(QueryCount>=50, 1, 0)
| eval IsHighCardinality=if(UniqueLabels>=40, 1, 0)
| eval IsLongLabelSkewed=if(AvgLabelLen>=28, 1, 0)
| eval TunnelScore=IsHighVolume+IsHighCardinality+IsLongLabelSkewed
| where TunnelScore>=2
| table host, User, Image, ApexDomain, QueryCount, UniqueLabels, AvgLabelLen, MaxLabelLen, SampleLabels, TunnelScore
| sort - TunnelScore, - QueryCount

dns where event.type == "start" and length(dns.question.subdomain) >= 20

SELECT
    "DNS Query Domain" AS ApexDomain,
    hostname AS Hostname,
    username AS User,
    COUNT(*) AS QueryCount,
    UNIQUECOUNT("DNS Query Name") AS UniqueLabels,
    AVG(LENGTH("DNS Query Name")) AS AvgQueryNameLen
FROM events
WHERE LOGSOURCETYPENAME(logsourceid) IN ('Microsoft Windows Sysmon', 'Infoblox NIOS', 'BIND DNS Server')
  AND LENGTH("DNS Query Name") >= 30
  AND starttime > NOW() - 86400000
GROUP BY "DNS Query Domain", hostname, username
HAVING COUNT(*) >= 50 AND UNIQUECOUNT("DNS Query Name") >= 40
ORDER BY QueryCount DESC

(_sourceCategory="windows/sysmon" OR _sourceCategory="endpoint/windows/sysmon") EventCode=22
| parse field=QueryName regex "(?<FirstLabel>^[^.]+)\." 
| parse field=QueryName regex "\.(?<ApexDomain>[^.]+\.[^.]+)$"
| where length(FirstLabel) >= 20
| count as QueryCount, count_distinct(FirstLabel) as UniqueLabels, avg(length(FirstLabel)) as AvgLabelLen by ComputerName, User, Image, ApexDomain
| where QueryCount >= 50 and UniqueLabels >= 40
| sort by QueryCount desc

rule dns_tunneling_exfiltration {
  meta:
    author = "df00tech"
    description = "Detects DNS tunneling exfiltration via long-label query volume and label cardinality"
    severity = "HIGH"
    mitre_attack_tactic = "Exfiltration"
    mitre_attack_technique = "T1048.003"
    reference = "https://attack.mitre.org/techniques/T1048/003/"

  events:
    $e.metadata.event_type = "NETWORK_DNS"
    $e.network.dns.questions.name = $qname
    re.regex($qname, `^[A-Za-z0-9+/_=-]{20,}\.`)
    $apex = re.capture($qname, `\.([A-Za-z0-9-]+\.[A-Za-z0-9-]+)$`)
    $hostname = $e.principal.hostname

  match:
    $hostname, $apex over 1h

  outcome:
    $query_count = count($qname)
    $unique_labels = count_distinct($qname)

  condition:
    $e and $query_count >= 50 and $unique_labels >= 40
}

#event_simpleName=DnsRequest
| DomainName=/^(?<FirstLabel>[A-Za-z0-9+\/_=-]{20,})\./
| ApexDomain := replace(field=DomainName, regex="^.*\.([A-Za-z0-9-]+\.[A-Za-z0-9-]+)$", with="\1")
| groupBy(
    [ComputerName, UserName, ApexDomain],
    function=[
      count(as=QueryCount),
      distinct_count(field=DomainName, as=UniqueLabels)
    ]
  )
| test(QueryCount >= 50 && UniqueLabels >= 40)
| sort(field=QueryCount, order=desc)