Subdomain Bruteforce Causing NXDOMAIN Storm

// THREAT: Subdomain Bruteforce NXDOMAIN Storm (Reconnaissance, T1596.001)
// Detects wordlist-driven subdomain enumeration against the organization's own
// DNS servers: a single client IP generating a very high query volume with an
// overwhelming NXDOMAIN ratio and near-1:1 unique-name-to-query ratio (each
// guess is a distinct label, unlike normal caching resolver traffic).
// Source: DnsEvents (Azure DNS Analytics solution / Microsoft DNS Server connector)
let LookbackWindow = 15m;
let MinTotalQueries = 200;
let MinNxDomainRatio = 0.85;
let MinUniqueLabelRatio = 0.90;
DnsEvents
| where TimeGenerated > ago(LookbackWindow)
| where QueryType in ("A", "AAAA", "CNAME", "MX", "TXT", "SRV", "NS")
| summarize
    TotalQueries = count(),
    UniqueSubdomains = dcount(Name),
    NxDomainCount = countif(ResultCode =~ "NXDOMAIN"),
    QueryTypes = make_set(QueryType, 10),
    SampleQueries = make_set(Name, 5),
    FirstSeen = min(TimeGenerated),
    LastSeen = max(TimeGenerated)
  by ClientIP, bin(TimeGenerated, LookbackWindow)
| extend NxDomainRatio = round(NxDomainCount * 1.0 / TotalQueries, 2)
| extend UniqueLabelRatio = round(UniqueSubdomains * 1.0 / TotalQueries, 2)
| where TotalQueries >= MinTotalQueries and NxDomainRatio >= MinNxDomainRatio and UniqueLabelRatio >= MinUniqueLabelRatio
| extend ThreatType = "SubdomainBruteforce_NXDOMAINStorm"
| extend Severity = iff(TotalQueries >= 2000, "High", "Medium")
| sort by TotalQueries desc

index=dns sourcetype=stream:dns
| eval QueryType=upper(coalesce(query_type, qtype_name, ""))
| eval QueryName=coalesce(query, query_name, name, "")
| eval SourceIP=coalesce(src_ip, src, client_ip)
| eval ResponseCode=upper(coalesce(rcode_name, reply_code, ""))
| where QueryType IN ("A", "AAAA", "CNAME", "MX", "TXT", "SRV", "NS")
| bin _time span=15m
| stats count AS TotalQueries,
    dc(QueryName) AS UniqueSubdomains,
    count(eval(ResponseCode="NXDOMAIN")) AS NxDomainCount,
    values(QueryType) AS QueryTypes
  BY _time, SourceIP
| eval NxDomainRatio=round(NxDomainCount/TotalQueries, 2)
| eval UniqueLabelRatio=round(UniqueSubdomains/TotalQueries, 2)
| where TotalQueries >= 200 AND NxDomainRatio >= 0.85 AND UniqueLabelRatio >= 0.90
| eval ThreatType="SubdomainBruteforce_NXDOMAINStorm"
| eval Severity=if(TotalQueries >= 2000, "HIGH", "MEDIUM")
| table _time, SourceIP, TotalQueries, UniqueSubdomains, NxDomainRatio, UniqueLabelRatio, QueryTypes, Severity
| sort - TotalQueries

sequence by source.ip with maxspan=15m
  [dns where dns.response_code == "NXDOMAIN"] with runs=200

SELECT
  sourceip AS SourceIP,
  COUNT(*) AS TotalQueries,
  COUNT(DISTINCT QNAME) AS UniqueSubdomains,
  SUM(CASE WHEN RCODE = 'NXDOMAIN' THEN 1 ELSE 0 END) AS NxDomainCount
FROM events
WHERE
  LOGSOURCETYPENAME(devicetype) ILIKE '%DNS%'
  AND starttime >= NOW() - 900000
GROUP BY sourceip, TRUNC(starttime, 900000)
HAVING COUNT(*) >= 200
  AND (SUM(CASE WHEN RCODE = 'NXDOMAIN' THEN 1 ELSE 0 END) * 1.0 / COUNT(*)) >= 0.85
  AND (COUNT(DISTINCT QNAME) * 1.0 / COUNT(*)) >= 0.90
ORDER BY TotalQueries DESC

_sourceCategory="dns/query"
| json "query_name" as QueryName
| json "response_code" as ResponseCode
| json "client_ip" as SourceIP
| timeslice 15m
| stats count AS TotalQueries, dcount(QueryName) AS UniqueSubdomains,
    count_if(ResponseCode="NXDOMAIN") AS NxDomainCount
  by SourceIP, _timeslice
| eval NxDomainRatio=round(NxDomainCount/TotalQueries, 2)
| eval UniqueLabelRatio=round(UniqueSubdomains/TotalQueries, 2)
| where TotalQueries >= 200 and NxDomainRatio >= 0.85 and UniqueLabelRatio >= 0.90
| sort by TotalQueries desc

rule subdomain_bruteforce_nxdomain_storm_t1596_001 {
  meta:
    author = "df00tech"
    description = "Detects high-volume subdomain bruteforce/enumeration against organizational DNS resulting in an NXDOMAIN storm from a single source"
    severity = "MEDIUM"
    priority = "MEDIUM"
    mitre_attack_tactic = "Reconnaissance"
    mitre_attack_technique = "T1596.001"
    version = "1.0"

  events:
    $e.metadata.event_type = "NETWORK_DNS"
    $e.network.dns.response_code = "NXDOMAIN"
    $e.principal.ip = $src_ip
    $e.network.dns.questions.name = $qname

  match:
    $src_ip over 15m

  outcome:
    $total_queries = count($e.metadata.id)
    $unique_subdomains = count_distinct($qname)

  condition:
    $total_queries >= 200 and $unique_subdomains >= 180
}

#repo=dns_logs event_type="DnsRequest"
| groupBy([client_ip, bin(time, 15m)], function=[
    count(as=TotalQueries),
    count(distinct=query_name, as=UniqueSubdomains),
    count(response_code="NXDOMAIN", as=NxDomainCount)
  ])
| eval NxDomainRatio := NxDomainCount / TotalQueries
| eval UniqueLabelRatio := UniqueSubdomains / TotalQueries
| test(TotalQueries >= 200 && NxDomainRatio >= 0.85 && UniqueLabelRatio >= 0.90)
| eval ThreatType := "SubdomainBruteforce_NXDOMAINStorm"
| sort(TotalQueries, order=desc, limit=1000)