Abnormally Large DNS Responseedit

Specially crafted DNS requests can manipulate a known overflow vulnerability in some Windows DNS servers which result in Remote Code Execution (RCE) or a Denial of Service (DoS) from crashing the service.

Rule type: query

Rule indices:

  • packetbeat-*
  • filebeat-*

Severity: medium

Risk score: 47

Runs every: 5 minutes

Searches indices from: now-6m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References:

Tags:

  • Elastic
  • Network
  • Threat Detection
  • Lateral Movement

Version: 4 (version history)

Added (Elastic Stack release): 7.10.0

Last modified (Elastic Stack release): 7.13.0

Rule authors: Elastic

Rule license: Elastic License v2

Potential false positivesedit

Environments that leverage DNS responses over 60k bytes will result in false positives - if this traffic is predictable and expected, it should be filtered out. Additionally, this detection rule could be triggered by an authorized vulnerability scan or compromise assessment.

Investigation guideedit

Triage and analysis

Investigating Large DNS Responses Detection alerts from this rule indicate an attempt was made to exploit CVE-2020-1350 (SigRed) through the use of large DNS responses on a Windows DNS server. Here are some possible avenues of investigation: - Investigate any corresponding Intrusion Detection Signatures (IDS) alerts that can validate this detection alert. - Examine the dns.question_type network fieldset with a protocol analyzer, such as Zeek, Packetbeat, or Suricata, for SIG or RRSIG data. - Validate the patch level and OS of the targeted DNS server to validate the observed activity was not large-scale Internet vulnerability scanning. - Validate that the source of the network activity was not from an authorized vulnerability scan or compromise assessment.

Rule queryedit

event.category:(network or network_traffic) and destination.port:53
and (event.dataset:zeek.dns or type:dns or event.type:connection) and
network.bytes > 60000

Threat mappingedit

Framework: MITRE ATT&CKTM

Rule version historyedit

Version 4 (7.13.0 release)
  • Formatting only
Version 3 (7.12.0 release)
  • Formatting only
Version 2 (7.11.2 release)
  • Formatting only