How to Detect DNS Tunneling with Elastic SIEM: SOC Analyst Hands-On Lab | Hunt Forward Lab #003

hunt will help you correlate the suspicious DNS activity back to a specific host and user account, while also estimating the volume of data exfiltrated through the tunnel.

Hunt 3: Correlate to Host and User, Estimate Exfiltration Volume

ES|QL Query:

esql
 
1FROM dns-tunnel-lab-logs
2| WHERE dns.question.type == "A"
3AND source.ip == "[SOURCE_IP]"
4AND dns.question.registered_domain == "exfil-c2.net"
5| EVAL subdomain_length = LENGTH(dns.question.subdomain)
6| STATS 
7    avg_subdomain_len = AVG(subdomain_length),
8    max_subdomain_len = MAX(subdomain_length),
9    total_queries = COUNT(),
10    unique_subdomains = COUNT_DISTINCT(dns.question.name),
11    first_seen = MIN(@timestamp),
12    last_seen = MAX(@timestamp),
13    active_days = COUNT_DISTINCT(DATE_TRUNC(1 day, @timestamp))
14BY source.ip, host.name

What Each Line Does:

• WHERE dns.question.type == "A": Filters for A record lookups.
• AND source.ip == "[SOURCE_IP]": Filters by the IP address identified in Hunt 1.
• `AND dns

Read the full article at InfoSec Write-ups - Medium

---

Want to create content about this topic? Use Nemati AI tools to generate articles, social posts, and more.