mirror of
https://github.com/valitydev/SigmaHQ.git
synced 2024-11-07 09:48:58 +00:00
23 lines
589 B
YAML
23 lines
589 B
YAML
title: Possible DNS Rebinding
|
|
status: experimental
|
|
description: 'Detects DNS-answer with TTL <10.'
|
|
date: 2019/10/25
|
|
author: Ilyas Ochkov, oscd.community
|
|
references:
|
|
- https://medium.com/@brannondorsey/attacking-private-networks-from-the-internet-with-dns-rebinding-ea7098a2d325
|
|
tags:
|
|
- attack.command_and_control
|
|
- attack.t1043
|
|
logsource:
|
|
product: dns
|
|
detection:
|
|
selection:
|
|
answer: '*'
|
|
filter1:
|
|
ttl: '>0'
|
|
filter2:
|
|
ttl: '<10'
|
|
timeframe: 30s
|
|
condition: selection and filter1 and filter2 | count(answer) by src_ip > 3
|
|
level: medium
|