sigred_cve20201350_dns_remote_code_exploit_via_httpproxy_logs

rule sigred_cve20201350_dns_remote_code_exploit_via_httpproxy_logs {
 meta:
    author = "SOC Prime Team"
    description = "Detects a possible exploitation of CVE-2020-1350 (aka SIGRED) using rare HTTP requests over port 53. HTTP should rarely (if ever) hosted on port 53.  License: https://github.com/Neo23x0/sigma/blob/master/LICENSE.Detection.Rules.md."
    reference = "https://tdm.socprime.com/tdm/info/mVWveD0Kpws4"
    version = "0.01"
    created = "2020/07/15"
    category = "proxy"
    mitre = "privilege_escalation, execution, t1068, t1190"

  events:
($port_53.target.port = "53" and not ((re.regex($port_53.principal.application, `.*Firefox/.*`) or re.regex($port_53.principal.application, `.*Chrome/.*`) or re.regex($port_53.principal.application, `.*CrisOS/.*`) or re.regex($port_53.principal.application, `.*OPR/.*`) or re.regex($port_53.principal.application, `.*Safari/.*`) or re.regex($port_53.principal.application, `.*Trident/.*`))))

  condition:
    $port_53
}