Skip to content

Commit 191512d

Browse files
aring87aring87
committed
added new triage guides
1 parent bf45073 commit 191512d

5 files changed

Lines changed: 451 additions & 0 deletions

File tree

‎content/triage-guides/sentinel/command-and-control/dns-tunneling-behavior.md‎

Lines changed: 90 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,90 @@
1+
# Triage Guide: DNS Tunneling Behavior
2+
3+
## Detection Title
4+
DNS Tunneling Behavior
5+
6+
## Detection ID
7+
SENT-C2-0001
8+
9+
## Objective
10+
11+
This detection identifies unusually high volumes of DNS traffic combined with long query lengths over a short time window. This may indicate DNS tunneling, covert beaconing, or encoded data transfer through DNS queries.
12+
13+
## Why It Matters
14+
15+
DNS tunneling can be used for:
16+
- covert command-and-control
17+
- data exfiltration
18+
- persistence of communications when web traffic is restricted
19+
- blending malicious traffic into commonly allowed DNS flows
20+
21+
High query counts plus long query strings are a useful signal for suspicious DNS abuse.
22+
23+
## Alert Logic Summary
24+
25+
The rule looks for:
26+
- `DeviceNetworkEvents`
27+
- DNS traffic on port 53
28+
- summarized activity over 15 minutes
29+
- high query counts
30+
- elevated average DNS query length
31+
32+
## Initial Triage Questions
33+
34+
- Which process is generating the DNS traffic?
35+
- Is the process normally DNS-heavy in this environment?
36+
- Are the queries abnormally long, repetitive, or high-entropy?
37+
- Does the traffic appear TXT-heavy or tunneling-like?
38+
- Is there related process execution or staging behavior?
39+
40+
## Investigation Steps
41+
42+
1. Review the initiating process name and user context.
43+
2. Confirm the host type and whether it normally generates heavy DNS traffic.
44+
3. Examine query characteristics if available:
45+
- query length
46+
- domain patterns
47+
- repetition
48+
- entropy-like appearance
49+
4. Review the 15-minute burst for volume and recurrence.
50+
5. Check for known developer, security, or diagnostics tools that may explain the behavior.
51+
6. Correlate with:
52+
- suspicious process execution
53+
- external downloads
54+
- archive creation
55+
- exfiltration-related activity
56+
57+
## Common False Positives
58+
59+
- developer tooling with frequent DNS lookups
60+
- internal diagnostics or troubleshooting tools
61+
- some security products or research tools
62+
- misconfigured scripts repeatedly resolving domains
63+
64+
## Escalation Guidance
65+
66+
Escalate when:
67+
- the generating process is unusual or suspicious
68+
- domains or queries look encoded or tunneled
69+
- activity is repeated across intervals
70+
- the host also shows execution or staging behavior
71+
- the user or host context makes the activity abnormal
72+
73+
## Recommended Enrichment
74+
75+
- destination domains if available
76+
- DNS query lengths and frequency
77+
- initiating process path and signer
78+
- process tree
79+
- related external network activity
80+
- file staging or archive activity
81+
- host role and criticality
82+
83+
## ATT&CK Mapping
84+
85+
- Command and Control
86+
- T1071.004 – Application Layer Protocol: DNS
87+
88+
## Related Rule
89+
90+
- `detections/sentinel/command-and-control/dns-tunneling-behavior.yml`

‎content/triage-guides/sentinel/command-and-control/dns-tunneling-using-iodine.md‎

Lines changed: 86 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,86 @@
1+
# Triage Guide: DNS Tunneling Using Iodine
2+
3+
## Detection Title
4+
DNS Tunneling Using Iodine
5+
6+
## Detection ID
7+
dodea-sig-033-dns-tunnel-iodine
8+
9+
## Objective
10+
11+
This detection identifies network connections over DNS port 53 from a process associated with Iodine, a known DNS tunneling tool. This may indicate covert command-and-control or data transfer using DNS as a transport mechanism.
12+
13+
## Why It Matters
14+
15+
DNS tunneling tools such as Iodine can be used to:
16+
- bypass network controls
17+
- establish covert command-and-control
18+
- move data through DNS traffic
19+
- hide malicious communications in a commonly allowed protocol
20+
21+
Use of Iodine on an endpoint is rarely normal in enterprise environments.
22+
23+
## Alert Logic Summary
24+
25+
The rule looks for:
26+
- `DeviceNetworkEvents`
27+
- `RemotePort == 53`
28+
- `InitiatingProcessFileName` containing `iodine`
29+
30+
## Initial Triage Questions
31+
32+
- Is Iodine approved or expected in this environment?
33+
- Which user executed the process?
34+
- Is the host a workstation, server, or test system?
35+
- Were there repeated DNS connections or sustained traffic?
36+
- Is there related suspicious process, archive, or exfiltration behavior?
37+
38+
## Investigation Steps
39+
40+
1. Review the initiating process name, path, and user context.
41+
2. Confirm whether the file is actually Iodine or similarly named masquerading content.
42+
3. Check the parent process and execution lineage.
43+
4. Review the timeline of DNS activity:
44+
- duration
45+
- frequency
46+
- destination patterns
47+
5. Determine whether the host also shows:
48+
- encoded command execution
49+
- archive creation
50+
- file staging
51+
- unusual external traffic
52+
6. Review whether the host role makes any legitimate tunneling activity plausible.
53+
54+
## Common False Positives
55+
56+
- lab or red team testing using Iodine
57+
- controlled security validation exercises
58+
- research systems intentionally running DNS tunnel tools
59+
60+
## Escalation Guidance
61+
62+
Escalate when:
63+
- Iodine execution is not explicitly authorized
64+
- DNS activity is sustained or repetitive
65+
- the host also shows staging, execution, or exfiltration behavior
66+
- the tool is executed from suspicious paths or by unusual accounts
67+
- the user cannot explain the activity
68+
69+
## Recommended Enrichment
70+
71+
- full process path
72+
- file hash and signer status
73+
- parent process
74+
- DNS request volume and timing
75+
- queried domains if available
76+
- related file, process, and network activity
77+
- host criticality and user role
78+
79+
## ATT&CK Mapping
80+
81+
- Command and Control
82+
- T1071.004 – Application Layer Protocol: DNS
83+
84+
## Related Rule
85+
86+
- `detections/sentinel/command-and-control/dns-tunneling-using-iodine.yml`

‎content/triage-guides/sentinel/command-and-control/external-powershell-or-lolbin-traffic.md‎

Lines changed: 94 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,94 @@
1+
# Triage Guide: External PowerShell or LOLBin Traffic
2+
3+
## Detection Title
4+
External PowerShell or LOLBin Traffic
5+
6+
## Detection ID
7+
dodea-sig-020-external-powershell-LOLBIN-traffic
8+
9+
## Objective
10+
11+
This detection identifies outbound connections to public IP space from PowerShell or common LOLBins such as `wscript.exe` and `mshta.exe`. This may indicate remote payload retrieval, callback traffic, or abuse of native Windows tooling for command-and-control.
12+
13+
## Why It Matters
14+
15+
PowerShell and LOLBins are commonly used to:
16+
- download remote payloads
17+
- execute scripts from the internet
18+
- establish outbound callbacks
19+
- proxy malicious traffic through trusted native binaries
20+
21+
External traffic from these tools is not always malicious, but it is high value for triage.
22+
23+
## Alert Logic Summary
24+
25+
The rule looks for:
26+
- `DeviceNetworkEvents`
27+
- `RemoteIPType == "Public"`
28+
- initiating process names:
29+
- `powershell.exe`
30+
- `wscript.exe`
31+
- `mshta.exe`
32+
33+
## Initial Triage Questions
34+
35+
- What process made the external connection?
36+
- Was the process launched interactively, by script, or by another binary?
37+
- Is the destination known and expected?
38+
- Was the user performing legitimate admin or automation work?
39+
- Did the process also execute suspicious commands, downloads, or script content?
40+
41+
## Investigation Steps
42+
43+
1. Review the initiating process and full command line if available in related telemetry.
44+
2. Identify the user, parent process, and execution chain.
45+
3. Review the destination:
46+
- IP
47+
- domain if available
48+
- reputation
49+
- geolocation if relevant
50+
4. Determine whether the connection aligns with:
51+
- approved automation
52+
- software update behavior
53+
- expected admin scripting
54+
5. Check for nearby suspicious events:
55+
- web downloads
56+
- encoded commands
57+
- child process launches
58+
- file writes to temp or user paths
59+
6. Review recurrence across the same host or account.
60+
61+
## Common False Positives
62+
63+
- administrative scripts reaching public services
64+
- support tooling using PowerShell or HTA frameworks
65+
- approved software bootstrap or update activity
66+
- scripted access to cloud APIs or public repos
67+
68+
## Escalation Guidance
69+
70+
Escalate when:
71+
- the external destination is suspicious or unknown
72+
- the process lineage is unusual
73+
- the tool is launched from user-writable paths or script hosts
74+
- there is follow-on execution, staging, or persistence
75+
- the user cannot explain the activity
76+
77+
## Recommended Enrichment
78+
79+
- full command line
80+
- parent and child processes
81+
- destination IP/domain details
82+
- file writes near the connection time
83+
- script block or PowerShell telemetry if available
84+
- related alerts on the same host
85+
- user role and host sensitivity
86+
87+
## ATT&CK Mapping
88+
89+
- Command and Control
90+
- T1071.001 – Application Layer Protocol: Web Protocols
91+
92+
## Related Rule
93+
94+
- `detections/sentinel/command-and-control/external-powershell-or-lolbin-traffic.yml`

‎content/triage-guides/sentinel/command-and-control/powershell-or-lolbin-external-network-traffic.md‎

Lines changed: 92 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,92 @@
1+
# Triage Guide: PowerShell or LOLBin External Network Traffic
2+
3+
## Detection Title
4+
PowerShell or LOLBin External Network Traffic
5+
6+
## Detection ID
7+
SENT-C2-0002
8+
9+
## Objective
10+
11+
This detection identifies outbound connections to external destinations from PowerShell and common LOLBins such as `mshta.exe`, `rundll32.exe`, `regsvr32.exe`, and `certutil.exe`. This may indicate payload retrieval, callback traffic, or remote content execution.
12+
13+
## Why It Matters
14+
15+
Adversaries frequently use built-in tools to:
16+
- contact remote infrastructure
17+
- fetch scripts or payloads
18+
- proxy malicious traffic through trusted binaries
19+
- establish command-and-control
20+
21+
These binaries have legitimate uses, but external network activity from them is often worth investigating.
22+
23+
## Alert Logic Summary
24+
25+
The rule looks for:
26+
- `DeviceNetworkEvents`
27+
- initiating processes:
28+
- `powershell.exe`
29+
- `pwsh.exe`
30+
- `mshta.exe`
31+
- `rundll32.exe`
32+
- `regsvr32.exe`
33+
- `certutil.exe`
34+
- remote IPs outside private address ranges
35+
36+
## Initial Triage Questions
37+
38+
- Which binary made the connection?
39+
- What launched it?
40+
- Is the external destination expected?
41+
- Was this a download, callback, or one-off connection?
42+
- Are there follow-on execution or persistence events?
43+
44+
## Investigation Steps
45+
46+
1. Review the initiating process and account context.
47+
2. Check the parent process and surrounding execution chain.
48+
3. Review the destination IP, domain, and port.
49+
4. Determine whether the tool normally talks externally in this environment.
50+
5. Look for nearby activity such as:
51+
- downloads
52+
- temp-file writes
53+
- DLL/script execution
54+
- persistence creation
55+
6. Assess whether the external connection occurred on a privileged host, server, or admin account.
56+
57+
## Common False Positives
58+
59+
- approved admin automation
60+
- software installation or update workflows
61+
- security or compliance scripts
62+
- support tools using public services
63+
64+
## Escalation Guidance
65+
66+
Escalate when:
67+
- the destination is suspicious or unrecognized
68+
- the process is spawned by unusual parents
69+
- the same host shows multiple suspicious LOLBin executions
70+
- there is evidence of staging or follow-on execution
71+
- the activity involves privileged users or critical systems
72+
73+
## Recommended Enrichment
74+
75+
- full command line
76+
- parent and child processes
77+
- destination domain/IP reputation
78+
- related file events
79+
- script or DLL load telemetry if available
80+
- recent alerts on the device
81+
- host criticality and user context
82+
83+
## ATT&CK Mapping
84+
85+
- Command and Control
86+
- Execution
87+
- T1105 – Ingress Tool Transfer
88+
- T1218 – System Binary Proxy Execution
89+
90+
## Related Rule
91+
92+
- `detections/sentinel/command-and-control/powershell-or-lolbin-external-network-traffic.yml`

0 commit comments

Comments
 (0)