DNS Base64 Encoded Query

Description

Detects DNS queries with Base64 encoded subdomains, which could indicate an attempt to obfuscate data exfil.

Query · python

from panther_base_helpers import defang_ioc, is_base64

DECODED = ""


def rule(event):
    query = event.udm("dns_query", default="")
    if not query:
        return False
    args = query.split(".")

    # Check if Base64 encoded arguments are present in the command line
    for arg in args:
        # pylint: disable=global-statement
        global DECODED
        DECODED = is_base64(arg)
        if DECODED:
            return True

    return False


def title(event):
    defang_query = defang_ioc(event.udm("dns_query")) if event.udm("dns_query") else "no query"
    return f'Base64 encoded query detected from [{event.udm("source_ip")}], [{defang_query}]'


def alert_context(event):
    context = {}
    context["source ip"] = event.udm("source_ip")
    context["defanged query"] = (
        defang_ioc(event.udm("dns_query")) if event.udm("dns_query") else "no query"
    )
    context["decoded url part"] = DECODED
    return context

Detection tier

Atomic IOCs
Network & Host Artifacts
Tools
TTPs
Pending classification

Metadata

Source: panther-labs/panther-analysis
License: Apache 2.0
Severity: Medium
Status: Experimental
Query type: python
Created: 2023-05-10
Modified: 2026-03-02
Authored by: panther-labs
Source ID
Upstream: rules/standard_rules/standard_dns_base64.yml
Type: rule
Version: 3
References: https://zofixer.com/what-is-base64-disclosure-vulnerability/
Data sources: AWS.VPCDnsCiscoUmbrella.DNSCrowdstrike.FDREvent

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.