IMPORTANT: No additional bug fixes or documentation updates will be released for this version. For the latest information, see the current release documentation.
« AWS WAF Rule or Rule Group Deletion Access of Stored Browser Credentials »
Elastic Docs ›Elastic Security Solution [7.15] ›Detections and alerts ›Prebuilt rule reference

Abnormally Large DNS Response

edit

Abnormally Large DNS Response

edit

Specially crafted DNS requests can manipulate a known overflow vulnerability in some Windows DNS servers which result in Remote Code Execution (RCE) or a Denial of Service (DoS) from crashing the service.

Rule type: query

Rule indices:

  • packetbeat-*
  • filebeat-*

Severity: medium

Risk score: 47

Runs every: 5 minutes

Searches indices from: now-6m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References:

Tags:

  • Elastic
  • Network
  • Threat Detection
  • Lateral Movement

Version: 4 (version history)

Added (Elastic Stack release): 7.10.0

Last modified (Elastic Stack release): 7.13.0

Rule authors: Elastic

Rule license: Elastic License v2

Potential false positives

edit

Environments that leverage DNS responses over 60k bytes will result in false positives - if this traffic is predictable and expected, it should be filtered out. Additionally, this detection rule could be triggered by an authorized vulnerability scan or compromise assessment.

Investigation guide

edit
## Triage and analysis

### Investigating Large DNS Responses
Detection alerts from this rule indicate an attempt was made to exploit CVE-2020-1350 (SigRed) through the use of large DNS responses on a Windows DNS server. Here are some possible avenues of investigation:
- Investigate any corresponding Intrusion Detection Signatures (IDS) alerts that can validate this detection alert.
- Examine the `dns.question_type` network fieldset with a protocol analyzer, such as Zeek, Packetbeat, or Suricata, for `SIG` or `RRSIG` data.
- Validate the patch level and OS of the targeted DNS server to validate the observed activity was not large-scale Internet vulnerability scanning.
- Validate that the source of the network activity was not from an authorized vulnerability scan or compromise assessment.

Rule query

edit
event.category:(network or network_traffic) and destination.port:53
and (event.dataset:zeek.dns or type:dns or event.type:connection)
and network.bytes > 60000

Threat mapping

edit

Framework: MITRE ATT&CKTM

Rule version history

edit
Version 4 (7.13.0 release)
  • Formatting only
Version 3 (7.12.0 release)
  • Formatting only
Version 2 (7.11.2 release)
  • Formatting only
« AWS WAF Rule or Rule Group Deletion Access of Stored Browser Credentials »