VPC Flow Logs Unapproved Outbound DNS Traffic

AnalysisType: rule
Filename: aws_vpc_unapproved_outbound_dns.py
RuleID: "AWS.VPC.UnapprovedOutboundDNS"
DisplayName: "VPC Flow Logs Unapproved Outbound DNS Traffic"
Enabled: false
LogTypes:
  - AWS.VPCFlow
  - OCSF.NetworkActivity
Tags:
  - AWS
  - DataModel
  - Configuration Required
  - Security Control
  - Command and Control:Application Layer Protocol
Reports:
  MITRE ATT&CK:
    - TA0011:T1071
Reference: https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html
Severity: Medium
Description: >
  Alerts if outbound DNS traffic is detected to a non-approved DNS server. DNS is often used as a means to exfiltrate data or perform command and control for compromised hosts. All DNS traffic should be routed through internal DNS servers or trusted 3rd parties.
Runbook: >
  Investigate the host sending unapproved DNS activity for signs of compromise or other malicious activity. Update network configurations appropriately to ensure all DNS traffic is routed to approved DNS servers.
SummaryAttributes:
  - srcaddr
  - dstaddr
  - dstport
Tests:
  - Name: Approved Outbound DNS Traffic
    ExpectedResult: false
    Log:
      {
        "dstPort": 53,
        "dstAddr": "1.1.1.1",
        "srcAddr": "10.0.0.1",
        "p_log_type": "AWS.VPCFlow",
      }
  - Name: Unapproved Outbound DNS Traffic
    ExpectedResult: true
    Log:
      {
        "dstPort": 53,
        "dstAddr": "100.100.100.100",
        "srcAddr": "10.0.0.1",
        "p_log_type": "AWS.VPCFlow",
      }
  - Name: Outbound Non-DNS Traffic
    ExpectedResult: false
    Log:
      {
        "dstPort": 80,
        "dstAddr": "100.100.100.100",
        "srcAddr": "10.0.0.1",
        "p_log_type": "AWS.VPCFlow",
      }
  - Name: Approved Outbound DNS Traffic - OCSF
    ExpectedResult: false
    Log:
      {
        "dst_endpoint": { "ip": "1.1.1.1", "port": 53 },
        "src_endpoint": { "ip": "10.0.0.1" },
        "p_log_type": "OCSF.NetworkActivity",
      }
  - Name: Unapproved Outbound DNS Traffic - OCSF
    ExpectedResult: true
    Log:
      {
        "dst_endpoint": { "ip": "100.100.100.100", "port": 53 },
        "src_endpoint": { "ip": "10.0.0.1" },
        "p_log_type": "OCSF.NetworkActivity",
      }


# ------ paired body: aws_vpc_unapproved_outbound_dns.py ------

from ipaddress import ip_network

from panther_aws_helpers import aws_rule_context

APPROVED_DNS_SERVERS = {
    "1.1.1.1",  # CloudFlare DNS
    "8.8.8.8",  # Google DNS
    # '10.0.0.1', # Internal DNS
}


def rule(event):
    # Common DNS ports, for better security use an application layer aware network monitor
    #
    # Defaults to True (no alert) if 'dstport' key is not present
    if event.udm("destination_port") != 53 and event.udm("destination_port") != 5353:
        return False

    # Only monitor traffic that is originating internally
    #
    # Defaults to True (no alert) if 'srcaddr' key is not present
    source_ip = event.udm("source_ip") or "0.0.0.0/32"
    if ip_network(source_ip).is_global:
        return False

    dest_ip = event.udm("destination_ip") or "192.168.0.1/32"
    if ip_network(dest_ip).is_private:
        return False

    # No clean way to default to False (no alert), so explicitly check for key
    return (
        bool(event.udm("destination_ip"))
        and event.udm("destination_ip") not in APPROVED_DNS_SERVERS
    )


def alert_context(event):
    return aws_rule_context(event)