AnalysisType: rule
Filename: crowdstrike_dns_request.py
RuleID: "Crowdstrike.DNS.Request"
DisplayName: "DNS request to denylisted domain"
Enabled: false
LogTypes:
- Crowdstrike.DNSRequest
- Crowdstrike.FDREvent
Tags:
- CrowdStrike
- Configuration Required
- DNS
- Command and Control
- Initial Access
- Exfiltration
- Threat Intelligence
- Network Monitoring
Severity: High
Reports:
MITRE ATT&CK:
- TA0001:T1566
- TA0011:T1071.004
- TA0010:T1567
Description: >
Detects DNS requests to domains on a custom denylist configured by security teams based on their threat landscape. This template rule requires configuration before enabling and monitors for C2 communication, phishing infrastructure, malware distribution, and data exfiltration. Organizations populate the denylist with threat intelligence indicators, known malicious infrastructure, and domains associated with targeted campaigns.
Reference: https://docs.runpanther.io/data-onboarding/supported-logs/crowdstrike#crowdstrike-dnsrequest
Runbook: |
1. Query CrowdStrike ProcessRollup events for ContextProcessId matching this DNS request to identify the process, user account, and parent process that initiated the query to DomainName
2. Search CrowdStrike DNS logs for all queries to the same DomainName from the affected host (aid) in the past 30 days to determine when it was first queried and the frequency of attempts
3. Hunt across all endpoints for other hosts querying the same denylisted domain using CrowdStrike IOC search to identify additional compromised systems in the campaign
DedupPeriodMinutes: 15
SummaryAttributes:
- DomainName
- aid
- p_any_domain_names
- p_any_ip_addresses
Tests:
- Name: Denylisted Domain
ExpectedResult: true
Log:
{
"event_simpleName": "DnsRequest",
"name": "DnsRequestMacV1",
"aid": "00000000000000000000000000000001",
"aip": "111.111.111.111",
"cid": "00000000000000000000000000000002",
"id": "11111111-0000-1111-0000-111111111111",
"event_platform": "Mac",
"timestamp": "2021-10-01 00:00:00.000Z",
"ConfigBuild": "1007.4.0014301.11",
"ConfigStateHash": "507116305",
"Entitlements": "15",
"ContextThreadId": "0",
"ContextTimeStamp": "2021-10-08 19:55:04.448Z",
"ContextProcessId": "111111111111111111",
"EffectiveTransmissionClass": 2,
"DomainName": "baddomain.com",
"RequestType": "1",
"p_event_time": "2021-10-08 19:55:04.448Z",
"p_parse_time": "2021-10-08 20:09:41.933Z",
"p_log_type": "Crowdstrike.DNSRequest",
"p_row_id": "2ed00000000000000000000000000001",
"p_source_id": "11111111-1111-1111-1111-111111111111",
"p_source_label": "Crowdstrike",
"p_any_ip_addresses": ["111.111.111.111"],
"p_any_domain_names": ["baddomain.com"],
"p_any_trace_ids":
[
"00000000000000000000000000000001",
"00000000000000000000000000000002",
],
}
- Name: Non-denylisted Domain
ExpectedResult: false
Log:
{
"event_simpleName": "DnsRequest",
"name": "DnsRequestMacV1",
"aid": "00000000000000000000000000000001",
"aip": "111.111.111.111",
"cid": "00000000000000000000000000000002",
"id": "11111111-0000-1111-0000-111111111111",
"event_platform": "Mac",
"timestamp": "2021-10-01 00:00:00.000Z",
"ConfigBuild": "1007.4.0014301.11",
"ConfigStateHash": "507116305",
"Entitlements": "15",
"ContextThreadId": "0",
"ContextTimeStamp": "2021-10-08 19:55:04.448Z",
"ContextProcessId": "111111111111111111",
"EffectiveTransmissionClass": 2,
"DomainName": "gooddomain.com",
"RequestType": "1",
"p_event_time": "2021-10-08 19:55:04.448Z",
"p_parse_time": "2021-10-08 20:09:41.933Z",
"p_log_type": "Crowdstrike.DNSRequest",
"p_row_id": "2ed00000000000000000000000000001",
"p_source_id": "11111111-1111-1111-1111-111111111111",
"p_source_label": "Crowdstrike",
"p_any_ip_addresses": ["111.111.111.111"],
"p_any_domain_names": ["gooddomain.com"],
"p_any_trace_ids":
[
"00000000000000000000000000000001",
"00000000000000000000000000000002",
],
}
- Name: Denylisted Domain (FDREvent)
ExpectedResult: true
Log:
{
"aid": "307dc41ce39744f060622095f2805249",
"aip": "10.0.0.0",
"cid": "0cfb1a68ef6b49fdb0d2b12725057057",
"ConfigBuild": "1007.4.0010306.1",
"ConfigStateHash": "156025532",
"ContextProcessId": "289977812183778042",
"ContextThreadId": "0",
"ContextTimestamp": "2020-05-24 23:50:06.989",
"Entitlements": "15",
"event":
{
"ConfigBuild": "1007.4.0010306.1",
"ConfigStateHash": "156025532",
"ContextProcessId": "289977812183778042",
"ContextThreadId": "0",
"ContextTimeStamp": "1590364206.989",
"DomainName": "baddomain.com",
"Entitlements": "15",
"RequestType": "1",
"aid": "307dc41ce39744f060622095f2805249",
"aip": "10.0.0.0",
"cid": "0cfb1a68ef6b49fdb0d2b12725057057",
"event_platform": "Mac",
"event_simpleName": "DnsRequest",
"id": "4be06eb8-9e19-11ea-a7b0-026c15f3d8ed",
"name": "DnsRequestMacV1",
"timestamp": "1590364207259",
},
"event_platform": "Mac",
"event_simplename": "DnsRequest",
"fdr_event_type": "DnsRequest",
"id": "4be06eb8-9e19-11ea-a7b0-026c15f3d8ed",
"name": "DnsRequestMacV1",
"p_any_domain_names": ["baddomain.com"],
"p_any_ip_addresses": ["10.0.0.0"],
"p_any_md5_hashes":
[
"0cfb1a68ef6b49fdb0d2b12725057057",
"307dc41ce39744f060622095f2805249",
],
"p_any_trace_ids":
[
"0cfb1a68ef6b49fdb0d2b12725057057",
"307dc41ce39744f060622095f2805249",
],
"p_event_time": "2020-05-24 23:50:06.989",
"p_log_type": "Crowdstrike.FDREvent",
"p_parse_time": "2023-01-26 12:17:58.141",
"p_row_id": "a21b385f60c08898ae918c84162d",
"p_schema_version": 0,
"timestamp": "2020-05-24 23:50:07.259",
}
- Name: Non-denylisted Domain (FDREvent)
ExpectedResult: false
Log:
{
"aid": "307dc41ce39744f060622095f2805249",
"aip": "10.0.0.0",
"cid": "0cfb1a68ef6b49fdb0d2b12725057057",
"ConfigBuild": "1007.4.0010306.1",
"ConfigStateHash": "156025532",
"ContextProcessId": "289977812183778042",
"ContextThreadId": "0",
"ContextTimeStamp": "2020-05-24 23:50:06.989",
"Entitlements": "15",
"event":
{
"ConfigBuild": "1007.4.0010306.1",
"ConfigStateHash": "156025532",
"ContextProcessId": "289977812183778042",
"ContextThreadId": "0",
"ContextTimeStamp": "1590364206.989",
"DomainName": "gooddomain.com",
"Entitlements": "15",
"RequestType": "1",
"aid": "307dc41ce39744f060622095f2805249",
"aip": "10.0.0.0",
"cid": "0cfb1a68ef6b49fdb0d2b12725057057",
"event_platform": "Mac",
"event_simpleName": "DnsRequest",
"id": "4be06eb8-9e19-11ea-a7b0-026c15f3d8ed",
"name": "DnsRequestMacV1",
"timestamp": "1590364207259",
},
"event_platform": "Mac",
"event_simplename": "DnsRequest",
"fdr_event_type": "DnsRequest",
"id": "4be06eb8-9e19-11ea-a7b0-026c15f3d8ed",
"name": "DnsRequestMacV1",
"p_any_domain_names": ["gooddomain.com"],
"p_any_ip_addresses": ["10.0.0.0"],
"p_any_md5_hashes":
[
"0cfb1a68ef6b49fdb0d2b12725057057",
"307dc41ce39744f060622095f2805249",
],
"p_any_trace_ids":
[
"0cfb1a68ef6b49fdb0d2b12725057057",
"307dc41ce39744f060622095f2805249",
],
"p_event_time": "2020-05-24 23:50:06.989",
"p_log_type": "Crowdstrike.FDREvent",
"p_parse_time": "2023-01-26 12:17:58.141",
"p_row_id": "a21b385f60c08898ae918c84162d",
"p_schema_version": 0,
"timestamp": "2020-05-24 23:50:07.259",
}
- Name: Denylisted Domain (but Non-DNS type) (FDREvent)
ExpectedResult: false
Log:
{
"event_simpleName": "Event_EppDetectionSummaryEvent",
"name": "DnsRequestMacV1",
"aid": "00000000000000000000000000000001",
"aip": "111.111.111.111",
"cid": "00000000000000000000000000000002",
"id": "11111111-0000-1111-0000-111111111111",
"event":
{
"aid": "00000000000000000000000000000001",
"event_simpleName": "Event_EppDetectionSummaryEvent",
"name": "DnsRequestMacV1",
"aip": "111.111.111.111",
"cid": "00000000000000000000000000000002",
"id": "11111111-0000-1111-0000-111111111111",
"event_platform": "Mac",
"timestamp": "2021-10-01 00:00:00.000Z",
"ConfigBuild": "1007.4.0014301.11",
"ConfigStateHash": "507116305",
"Entitlements": "15",
"ContextThreadId": "0",
"ContextTimeStamp": "2021-10-08 19:55:04.448Z",
"ContextProcessId": "111111111111111111",
"EffectiveTransmissionClass": 2,
"DomainName": "baddomain.com",
"RequestType": "1",
},
"event_platform": "Mac",
"fdr_event_type": "Event_EppDetectionSummaryEvent",
"timestamp": "2021-10-01 00:00:00.000Z",
"ConfigBuild": "1007.4.0014301.11",
"ConfigStateHash": "507116305",
"Entitlements": "15",
"ContextThreadId": "0",
"ContextTimeStamp": "2021-10-08 19:55:04.448Z",
"ContextProcessId": "111111111111111111",
"EffectiveTransmissionClass": 2,
"RequestType": "1",
"p_event_time": "2021-10-08 19:55:04.448Z",
"p_parse_time": "2021-10-08 20:09:41.933Z",
"p_log_type": "Crowdstrike.FDREvent",
"p_row_id": "2ed00000000000000000000000000001",
"p_source_id": "11111111-1111-1111-1111-111111111111",
"p_source_label": "Crowdstrike",
"p_any_ip_addresses": ["111.111.111.111"],
"p_any_domain_names": ["baddomain.com"],
"p_any_trace_ids":
[
"00000000000000000000000000000001",
"00000000000000000000000000000002",
],
}
# ------ paired body: crowdstrike_dns_request.py ------
from panther_crowdstrike_fdr_helpers import filter_crowdstrike_fdr_event_type, get_crowdstrike_field
# baddomain.com is present for testing purposes. Add domains you wish to be alerted on to this list
DENYLIST = ["baddomain.com"]
def rule(event):
# We need to run either for Crowdstrike.DnsRequest or for Crowdstrike.FDREvent with the
# 'DnsRequest' fdr_event_type. Crowdstrike.DnsRequest is covered because of the
# association with the type
if filter_crowdstrike_fdr_event_type(event, "DnsRequest"):
return False
if get_crowdstrike_field(event, "DomainName") in DENYLIST:
return True
return False
def title(event):
host = event.get("ComputerName") or event.get("aid", "<AID_NOT_FOUND>")
return (
f"A denylisted domain [{get_crowdstrike_field(event, 'DomainName')}] was "
+ f"queried by host {host}"
)
def dedup(event):
# Alert on every individual lookup of a bad domain, per machine
return f"{get_crowdstrike_field(event, 'DomainName')}-{event.get('aid')}"