diff --git a/Solutions/Windows Server DNS/Data/Solution_DNS.json b/Solutions/Windows Server DNS/Data/Solution_DNS.json index 5de058eba79..84392bfcc65 100644 --- a/Solutions/Windows Server DNS/Data/Solution_DNS.json +++ b/Solutions/Windows Server DNS/Data/Solution_DNS.json @@ -29,11 +29,19 @@ "Hunting Queries/Solorigate-Encoded-Domain-URL.yaml" ], "BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\Windows Server DNS", - "Version": "3.0.1", + "Version": "3.2.2", "Metadata": "SolutionMetadata.json", "TemplateSpec": true, "StaticDataConnectorIds": [ "ASimDnsActivityLogs", "DNS" + ], + "XDR Workbooks": [], + "XDR Detections": [ + "XDR Detections/DNS_HighNXDomainCount_detection.yaml", + "XDR Detections/DNS_HighReverseDNSCount_detection.yaml", + "XDR Detections/DNS_Miners.yaml", + "XDR Detections/DNS_TorProxies.yaml", + "XDR Detections/NRT_DNS_Related_To_Mining_Pools.yaml" ] } diff --git a/Solutions/Windows Server DNS/Package/3.2.2.zip b/Solutions/Windows Server DNS/Package/3.2.2.zip new file mode 100644 index 00000000000..5dc973342e4 Binary files /dev/null and b/Solutions/Windows Server DNS/Package/3.2.2.zip differ diff --git a/Solutions/Windows Server DNS/Package/createUiDefinition.json b/Solutions/Windows Server DNS/Package/createUiDefinition.json index 55476ece4d5..61f5969213f 100644 --- a/Solutions/Windows Server DNS/Package/createUiDefinition.json +++ b/Solutions/Windows Server DNS/Package/createUiDefinition.json @@ -6,7 +6,7 @@ "config": { "isWizard": false, "basics": { - "description": "\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Windows%20Server%20DNS/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe [DNS](https://docs.microsoft.com/windows-server/networking/dns/dns-top) solution for Microsoft Sentinel allows you to ingest DNS analytic and audit logs into Microsoft Sentinel. The DNS logs are collected only from Windows agents.\n\nInstalling this solution will deploy two data connectors,\n\r\n1. DNS via AMA - This data connector helps in ingesting Windows DNS logs into your Log Analytics Workspace using the new Azure Monitor Agent. Learn more about ingesting using the new Azure Monitor Agent [here](https://learn.microsoft.com/en-us/azure/sentinel/connect-dns-ama). Microsoft recommends using this Data Connector.\r\n\n2. DNS via Legacy Agent - This data connector helps in ingesting Windows DNS logs into your Log Analytics Workspace using the legacy Log Analytics agent.\n\r\n

**NOTE**: Microsoft recommends Installation of DNS via AMA. Legacy connector uses the Log Analytics agent which is about to be deprecated by **Aug 31, 2024,** and thus should only be installed where AMA is not supported.\n\n**Data Connectors:** 2, **Workbooks:** 1, **Analytic Rules:** 5, **Hunting Queries:** 9\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", + "description": "\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Windows%20Server%20DNS/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe [DNS](https://docs.microsoft.com/windows-server/networking/dns/dns-top) solution for Microsoft Sentinel allows you to ingest DNS analytic and audit logs into Microsoft Sentinel. The DNS logs are collected only from Windows agents.\n\nInstalling this solution will deploy two data connectors,\n\r\n1. DNS via AMA - This data connector helps in ingesting Windows DNS logs into your Log Analytics Workspace using the new Azure Monitor Agent. Learn more about ingesting using the new Azure Monitor Agent [here](https://learn.microsoft.com/en-us/azure/sentinel/connect-dns-ama). Microsoft recommends using this Data Connector.\r\n\n2. DNS via Legacy Agent - This data connector helps in ingesting Windows DNS logs into your Log Analytics Workspace using the legacy Log Analytics agent.\n\r\n

**NOTE**: Microsoft recommends Installation of DNS via AMA. Legacy connector uses the Log Analytics agent which is about to be deprecated by **Aug 31, 2024,** and thus should only be installed where AMA is not supported.\n\n**Data Connectors:** 2, **Workbooks:** 1, **Analytic Rules:** 5, **XDR Detections:** 5, **Hunting Queries:** 9\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", "subscription": { "resourceProviders": [ "Microsoft.OperationsManagement/solutions", @@ -51,6 +51,47 @@ } ], "steps": [ + { + "name": "contentSelection", + "label": "Content selection", + "elements": [ + { + "name": "DeployAnalyticsRule", + "type": "Microsoft.Common.CheckBox", + "label": "DeployAnalyticsRule", + "defaultValue": true, + "toolTip": "Deploy the Microsoft Sentinel analytic rules carried by this solution (ContentKind AnalyticsRule and its AnalyticsRuleTemplate registration face)." + }, + { + "name": "DeployWorkbook", + "type": "Microsoft.Common.CheckBox", + "label": "DeployWorkbook", + "defaultValue": true, + "toolTip": "Deploy the Microsoft Sentinel workbook content and its Content Hub registration carried by this solution (ContentKind Workbook and WorkbookTemplate)." + }, + { + "name": "DeployDataConnector", + "type": "Microsoft.Common.CheckBox", + "label": "DeployDataConnector", + "defaultValue": true, + "toolTip": "Deploy the data connectors carried by this solution, together with their metadata and catalog entries (ContentKind DataConnector, ResourceDataConnector and DataType)." + }, + { + "name": "DeployCustomDetection", + "type": "Microsoft.Common.CheckBox", + "label": "DeployCustomDetection", + "defaultValue": false, + "toolTip": "Deploy the XDR-native custom detection resources and their Content Hub registrations (ContentKind CustomDetection and CustomDetectionTemplate). Independent of DeployAnalyticsRule: both kinds can be selected together. Existing analytic-rule instances are not disabled or removed. CD enabled or disabled status is controlled separately from this deployment switch." + }, + { + "name": "DeployHuntingQuery", + "type": "Microsoft.Common.CheckBox", + "label": "DeployHuntingQuery", + "defaultValue": true, + "toolTip": "Deploy the Microsoft Sentinel hunting queries carried by this solution." + } + ] + }, { "name": "dataconnectors", "label": "Data Connectors", @@ -60,28 +101,14 @@ "name": "dataconnectors1-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "Installing this solution will deploy two data connectors," + "text": "This Solution installs the data connector for Windows Server DNS. You can get Windows Server DNS custom log data in your Microsoft Sentinel workspace. After installing the solution, configure and enable this data connector by following guidance in Manage solution view." } }, { "name": "dataconnectors2-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "1. DNS via AMA - This data connector helps in ingesting Windows DNS logs into your Log Analytics Workspace using the new Azure Monitor Agent. Learn more about ingesting using the new Azure Monitor Agent here (https://learn.microsoft.com/en-us/azure/sentinel/connect-dns-ama). Microsoft recommends using this Data Connector." - } - }, - { - "name": "dataconnectors3-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "2. DNS via Legacy Agent - This data connector helps in ingesting Windows DNS logs into your Log Analytics Workspace using the legacy Log Analytics agent." - } - }, - { - "name": "dataconnectors4-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "NOTE: Microsoft recommends Installation of DNS via AMA. Legacy connector uses the Log Analytics agent which is about to be deprecated by Aug 31, 2024, and thus should only be installed where AMA is not supported." + "text": "This Solution installs the data connector for Windows Server DNS. You can get Windows Server DNS custom log data in your Microsoft Sentinel workspace. After installing the solution, configure and enable this data connector by following guidance in Manage solution view." } }, { @@ -173,7 +200,7 @@ "name": "analytic1-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "Identifies clients with a high NXDomain count, which could be indicative of a DGA (cycling through possible C2 domains where most C2s are not live).\nAlerts are generated when a new IP address is seen (based on not being associated with\nNXDomain records in the prior 10-day baseline period)." + "text": "Identifies clients with a high NXDomain count, which could be indicative of a DGA (cycling through possible C2 domains where most C2s are not live).\nAlerts are generated when a new IP address is seen (based on not being associated with NXDomain records in the prior 10-day baseline period)." } } ] @@ -390,7 +417,12 @@ "outputs": { "workspace-location": "[first(map(filter(basics('getLAWorkspace').value, (filter) => and(contains(toLower(filter.id), toLower(resourceGroup().name)),equals(filter.name,basics('workspace')))), (item) => item.location))]", "location": "[location()]", - "workspace": "[basics('workspace')]" + "workspace": "[basics('workspace')]", + "DeployAnalyticsRule": "[steps('contentSelection').DeployAnalyticsRule]", + "DeployWorkbook": "[steps('contentSelection').DeployWorkbook]", + "DeployDataConnector": "[steps('contentSelection').DeployDataConnector]", + "DeployCustomDetection": "[steps('contentSelection').DeployCustomDetection]", + "DeployHuntingQuery": "[steps('contentSelection').DeployHuntingQuery]" } } } diff --git a/Solutions/Windows Server DNS/Package/mainTemplate.json b/Solutions/Windows Server DNS/Package/mainTemplate.json index 4b3daae8f30..7514c9b46cc 100644 --- a/Solutions/Windows Server DNS/Package/mainTemplate.json +++ b/Solutions/Windows Server DNS/Package/mainTemplate.json @@ -35,13 +35,48 @@ "metadata": { "description": "Name for the workbook" } + }, + "DeployAnalyticsRule": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Deploy the Microsoft Sentinel analytic rules carried by this solution (ContentKind AnalyticsRule and its AnalyticsRuleTemplate registration face)." + } + }, + "DeployWorkbook": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Deploy the Microsoft Sentinel workbook content and its Content Hub registration carried by this solution (ContentKind Workbook and WorkbookTemplate)." + } + }, + "DeployDataConnector": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Deploy the data connectors carried by this solution, together with their metadata and catalog entries (ContentKind DataConnector, ResourceDataConnector and DataType)." + } + }, + "DeployCustomDetection": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Deploy the XDR-native custom detection resources and their Content Hub registrations (ContentKind CustomDetection and CustomDetectionTemplate). Independent of DeployAnalyticsRule: both kinds can be selected together. Existing analytic-rule instances are not disabled or removed. CD enabled or disabled status is controlled separately from this deployment switch." + } + }, + "DeployHuntingQuery": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Deploy the Microsoft Sentinel hunting queries carried by this solution." + } } }, "variables": { "email": "support@microsoft.com", "_email": "[variables('email')]", "_solutionName": "Windows Server DNS", - "_solutionVersion": "3.0.1", + "_solutionVersion": "3.2.2", "solutionId": "azuresentinel.azure-sentinel-solution-dns", "_solutionId": "[variables('solutionId')]", "uiConfigId1": "DNS", @@ -161,7 +196,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Windows Server DNS data connector with template version 3.0.1", + "description": "Windows Server DNS data connector with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('dataConnectorVersion1')]", @@ -252,7 +287,8 @@ "contentProductId": "[variables('_dataConnectorcontentProductId1')]", "id": "[variables('_dataConnectorcontentProductId1')]", "version": "[variables('dataConnectorVersion1')]" - } + }, + "condition": "[parameters('DeployDataConnector')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", @@ -282,7 +318,8 @@ "tier": "Microsoft", "link": "https://support.microsoft.com" } - } + }, + "condition": "[parameters('DeployDataConnector')]" }, { "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId1'))]", @@ -327,7 +364,8 @@ ], "id": "[variables('_uiConfigId1')]" } - } + }, + "condition": "[parameters('DeployDataConnector')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -338,7 +376,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Windows Server DNS data connector with template version 3.0.1", + "description": "Windows Server DNS data connector with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('dataConnectorVersion2')]", @@ -418,7 +456,8 @@ "contentProductId": "[variables('_dataConnectorcontentProductId2')]", "id": "[variables('_dataConnectorcontentProductId2')]", "version": "[variables('dataConnectorVersion2')]" - } + }, + "condition": "[parameters('DeployDataConnector')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", @@ -448,7 +487,8 @@ "tier": "Microsoft", "link": "https://support.microsoft.com" } - } + }, + "condition": "[parameters('DeployDataConnector')]" }, { "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId2'))]", @@ -482,7 +522,8 @@ ], "id": "[variables('_uiConfigId2')]" } - } + }, + "condition": "[parameters('DeployDataConnector')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -493,7 +534,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Dns Workbook with template version 3.0.1", + "description": "Dns Workbook with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('workbookVersion1')]", @@ -574,7 +615,8 @@ "contentProductId": "[variables('_workbookcontentProductId1')]", "id": "[variables('_workbookcontentProductId1')]", "version": "[variables('workbookVersion1')]" - } + }, + "condition": "[parameters('DeployWorkbook')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -585,7 +627,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "DNS_HighNXDomainCount_detection_AnalyticalRules Analytics Rule with template version 3.0.1", + "description": "DNS_HighNXDomainCount_detection_AnalyticalRules Analytics Rule with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject1').analyticRuleVersion1]", @@ -613,10 +655,10 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "DNS", "dataTypes": [ "DnsEvents" - ], - "connectorId": "DNS" + ] } ], "tactics": [ @@ -679,7 +721,8 @@ "contentProductId": "[variables('analyticRuleObject1')._analyticRulecontentProductId1]", "id": "[variables('analyticRuleObject1')._analyticRulecontentProductId1]", "version": "[variables('analyticRuleObject1').analyticRuleVersion1]" - } + }, + "condition": "[parameters('DeployAnalyticsRule')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -690,7 +733,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "DNS_HighReverseDNSCount_detection_AnalyticalRules Analytics Rule with template version 3.0.1", + "description": "DNS_HighReverseDNSCount_detection_AnalyticalRules Analytics Rule with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject2').analyticRuleVersion2]", @@ -718,10 +761,10 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "DNS", "dataTypes": [ "DnsEvents" - ], - "connectorId": "DNS" + ] } ], "tactics": [ @@ -783,7 +826,8 @@ "contentProductId": "[variables('analyticRuleObject2')._analyticRulecontentProductId2]", "id": "[variables('analyticRuleObject2')._analyticRulecontentProductId2]", "version": "[variables('analyticRuleObject2').analyticRuleVersion2]" - } + }, + "condition": "[parameters('DeployAnalyticsRule')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -794,7 +838,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "DNS_Miners_AnalyticalRules Analytics Rule with template version 3.0.1", + "description": "DNS_Miners_AnalyticalRules Analytics Rule with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject3').analyticRuleVersion3]", @@ -822,10 +866,10 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "DNS", "dataTypes": [ "DnsEvents" - ], - "connectorId": "DNS" + ] } ], "tactics": [ @@ -904,7 +948,8 @@ "contentProductId": "[variables('analyticRuleObject3')._analyticRulecontentProductId3]", "id": "[variables('analyticRuleObject3')._analyticRulecontentProductId3]", "version": "[variables('analyticRuleObject3').analyticRuleVersion3]" - } + }, + "condition": "[parameters('DeployAnalyticsRule')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -915,7 +960,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "DNS_TorProxies_AnalyticalRules Analytics Rule with template version 3.0.1", + "description": "DNS_TorProxies_AnalyticalRules Analytics Rule with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject4').analyticRuleVersion4]", @@ -943,10 +988,10 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "DNS", "dataTypes": [ "DnsEvents" - ], - "connectorId": "DNS" + ] } ], "tactics": [ @@ -1025,7 +1070,8 @@ "contentProductId": "[variables('analyticRuleObject4')._analyticRulecontentProductId4]", "id": "[variables('analyticRuleObject4')._analyticRulecontentProductId4]", "version": "[variables('analyticRuleObject4').analyticRuleVersion4]" - } + }, + "condition": "[parameters('DeployAnalyticsRule')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -1036,7 +1082,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "NRT_DNS_Related_To_Mining_Pools_AnalyticalRules Analytics Rule with template version 3.0.1", + "description": "NRT_DNS_Related_To_Mining_Pools_AnalyticalRules Analytics Rule with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject5').analyticRuleVersion5]", @@ -1060,10 +1106,10 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "DNS", "dataTypes": [ "DnsEvents" - ], - "connectorId": "DNS" + ] } ], "tactics": [ @@ -1142,7 +1188,8 @@ "contentProductId": "[variables('analyticRuleObject5')._analyticRulecontentProductId5]", "id": "[variables('analyticRuleObject5')._analyticRulecontentProductId5]", "version": "[variables('analyticRuleObject5').analyticRuleVersion5]" - } + }, + "condition": "[parameters('DeployAnalyticsRule')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -1153,7 +1200,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "DNS_CommonlyAbusedTLDs_HuntingQueries Hunting Query with template version 3.0.1", + "description": "DNS_CommonlyAbusedTLDs_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject1').huntingQueryVersion1]", @@ -1227,7 +1274,8 @@ "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject1')._huntingQuerycontentId1,'-', '1.0.0')))]", "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject1')._huntingQuerycontentId1,'-', '1.0.0')))]", "version": "1.0.0" - } + }, + "condition": "[parameters('DeployHuntingQuery')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -1238,7 +1286,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "DNS_DomainAnomalousLookupIncrease_HuntingQueries Hunting Query with template version 3.0.1", + "description": "DNS_DomainAnomalousLookupIncrease_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject2').huntingQueryVersion2]", @@ -1312,7 +1360,8 @@ "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject2')._huntingQuerycontentId2,'-', '1.0.0')))]", "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject2')._huntingQuerycontentId2,'-', '1.0.0')))]", "version": "1.0.0" - } + }, + "condition": "[parameters('DeployHuntingQuery')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -1323,7 +1372,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "DNS_FullNameAnomalousLookupIncrease_HuntingQueries Hunting Query with template version 3.0.1", + "description": "DNS_FullNameAnomalousLookupIncrease_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject3').huntingQueryVersion3]", @@ -1397,7 +1446,8 @@ "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject3')._huntingQuerycontentId3,'-', '1.0.0')))]", "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject3')._huntingQuerycontentId3,'-', '1.0.0')))]", "version": "1.0.0" - } + }, + "condition": "[parameters('DeployHuntingQuery')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -1408,7 +1458,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "DNS_HighPercentNXDomainCount_HuntingQueries Hunting Query with template version 3.0.1", + "description": "DNS_HighPercentNXDomainCount_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject4').huntingQueryVersion4]", @@ -1482,7 +1532,8 @@ "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject4')._huntingQuerycontentId4,'-', '1.0.0')))]", "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject4')._huntingQuerycontentId4,'-', '1.0.0')))]", "version": "1.0.0" - } + }, + "condition": "[parameters('DeployHuntingQuery')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -1493,7 +1544,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "DNS_HighReverseDNSCount_HuntingQueries Hunting Query with template version 3.0.1", + "description": "DNS_HighReverseDNSCount_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject5').huntingQueryVersion5]", @@ -1567,7 +1618,8 @@ "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject5')._huntingQuerycontentId5,'-', '1.0.0')))]", "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject5')._huntingQuerycontentId5,'-', '1.0.0')))]", "version": "1.0.0" - } + }, + "condition": "[parameters('DeployHuntingQuery')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -1578,7 +1630,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "DNS_LongURILookup_HuntingQueries Hunting Query with template version 3.0.1", + "description": "DNS_LongURILookup_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject6').huntingQueryVersion6]", @@ -1652,7 +1704,8 @@ "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject6')._huntingQuerycontentId6,'-', '1.0.0')))]", "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject6')._huntingQuerycontentId6,'-', '1.0.0')))]", "version": "1.0.0" - } + }, + "condition": "[parameters('DeployHuntingQuery')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -1663,7 +1716,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "DNS_WannaCry_HuntingQueries Hunting Query with template version 3.0.1", + "description": "DNS_WannaCry_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject7').huntingQueryVersion7]", @@ -1737,7 +1790,8 @@ "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject7')._huntingQuerycontentId7,'-', '1.0.0')))]", "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject7')._huntingQuerycontentId7,'-', '1.0.0')))]", "version": "1.0.0" - } + }, + "condition": "[parameters('DeployHuntingQuery')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -1748,7 +1802,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Solorigate-DNS-Pattern_HuntingQueries Hunting Query with template version 3.0.1", + "description": "Solorigate-DNS-Pattern_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject8').huntingQueryVersion8]", @@ -1822,7 +1876,8 @@ "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject8')._huntingQuerycontentId8,'-', '1.0.0')))]", "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject8')._huntingQuerycontentId8,'-', '1.0.0')))]", "version": "1.0.0" - } + }, + "condition": "[parameters('DeployHuntingQuery')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -1833,7 +1888,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Solorigate-Encoded-Domain-URL_HuntingQueries Hunting Query with template version 3.0.1", + "description": "Solorigate-Encoded-Domain-URL_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject9').huntingQueryVersion9]", @@ -1907,19 +1962,20 @@ "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject9')._huntingQuerycontentId9,'-', '1.0.0')))]", "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject9')._huntingQuerycontentId9,'-', '1.0.0')))]", "version": "1.0.0" - } + }, + "condition": "[parameters('DeployHuntingQuery')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentPackages", "apiVersion": "2023-04-01-preview", "location": "[parameters('workspace-location')]", "properties": { - "version": "3.0.1", + "version": "3.2.2", "kind": "Solution", "contentSchemaVersion": "3.0.0", "displayName": "Windows Server DNS", "publisherDisplayName": "Microsoft Sentinel, Microsoft Corporation", - "descriptionHtml": "

Note: Please refer to the following before installing the solution:

\n

• Review the solution Release Notes

\n

• There may be known issues pertaining to this Solution, please refer to them before installing.

\n

The DNS solution for Microsoft Sentinel allows you to ingest DNS analytic and audit logs into Microsoft Sentinel. The DNS logs are collected only from Windows agents.

\n

Installing this solution will deploy two data connectors,

\n
    \n

  1. DNS via AMA - This data connector helps in ingesting Windows DNS logs into your Log Analytics Workspace using the new Azure Monitor Agent. Learn more about ingesting using the new Azure Monitor Agent here. Microsoft recommends using this Data Connector.

    \n
    2. \n

  2. DNS via Legacy Agent - This data connector helps in ingesting Windows DNS logs into your Log Analytics Workspace using the legacy Log Analytics agent.

    \n
    3. \n
\n

**NOTE**: Microsoft recommends Installation of DNS via AMA. Legacy connector uses the Log Analytics agent which is about to be deprecated by **Aug 31, 2024,** and thus should only be installed where AMA is not supported.\n

Data Connectors: 2, Workbooks: 1, Analytic Rules: 5, Hunting Queries: 9

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", + "descriptionHtml": "

Note: Please refer to the following before installing the solution:

\n

• Review the solution Release Notes

\n

• There may be known issues pertaining to this Solution, please refer to them before installing.

\n

The DNS solution for Microsoft Sentinel allows you to ingest DNS analytic and audit logs into Microsoft Sentinel. The DNS logs are collected only from Windows agents.

\n

Installing this solution will deploy two data connectors,

\n
    \n

  1. DNS via AMA - This data connector helps in ingesting Windows DNS logs into your Log Analytics Workspace using the new Azure Monitor Agent. Learn more about ingesting using the new Azure Monitor Agent here. Microsoft recommends using this Data Connector.

    \n
    2. \n

  2. DNS via Legacy Agent - This data connector helps in ingesting Windows DNS logs into your Log Analytics Workspace using the legacy Log Analytics agent.

    \n
    3. \n
\n

**NOTE**: Microsoft recommends Installation of DNS via AMA. Legacy connector uses the Log Analytics agent which is about to be deprecated by **Aug 31, 2024,** and thus should only be installed where AMA is not supported.\n

Data Connectors: 2, Workbooks: 1, Analytic Rules: 5, XDR Detections: 5, Hunting Queries: 9

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", "contentKind": "Solution", "contentProductId": "[variables('_solutioncontentProductId')]", "id": "[variables('_solutioncontentProductId')]", @@ -2028,6 +2084,31 @@ "kind": "HuntingQuery", "contentId": "[variables('huntingQueryObject9')._huntingQuerycontentId9]", "version": "[variables('huntingQueryObject9').huntingQueryVersion9]" + }, + { + "kind": "CustomDetection", + "contentId": "xdr-a0907abe-6925-4d90-af2b-c7e89dc201a6", + "version": "3.2.1" + }, + { + "kind": "CustomDetection", + "contentId": "xdr-15ae38a2-2e29-48f7-883f-863fb25a5a06", + "version": "3.2.1" + }, + { + "kind": "CustomDetection", + "contentId": "xdr-0d76e9cf-788d-4a69-ac7d-f234826b5bed", + "version": "3.2.1" + }, + { + "kind": "CustomDetection", + "contentId": "xdr-a83ef0f4-dace-4767-bce3-ebd32599d2a0", + "version": "3.2.1" + }, + { + "kind": "CustomDetection", + "contentId": "xdr-d5b32cd4-2328-43da-ab47-cd289c1f5efc", + "version": "3.2.1" } ] }, @@ -2042,6 +2123,967 @@ } }, "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', variables('_solutionId'))]" + }, + { + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "WindowsServerDNS-CD-xdr-a0907abe-6925-4d90-af2b-c7e89dc201a6", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "mode": "Incremental", + "expressionEvaluationOptions": { + "scope": "inner" + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "imports": { + "MicrosoftSecurity": { + "provider": "MicrosoftSecurity", + "version": "1.0.0" + } + }, + "resources": { + "detectionRule": { + "import": "MicrosoftSecurity", + "type": "Microsoft.Security/detectionRules@2026-06-01-preview", + "properties": { + "status": "disabled", + "schedule": { + "frequency": "P1D" + }, + "id": "[if(true(), 'xdr-a0907abe-6925-4d90-af2b-c7e89dc201a6', 'xdr-a0907abe-6925-4d90-af2b-c7e89dc201a6')]", + "queryCondition": { + "queryText": "let starttime = 10d;\nlet endtime = 1d;\nlet threshold = 100;\nlet nxDomainDnsEvents = DnsEvents\n// ResultCode 3 => 'NXDOMAIN'\n| where ResultCode == 3\n| where QueryType in~ (\"A\", \"AAAA\")\n| where ipv4_is_match(\"127.0.0.1\", ClientIP) == False\n| where Name !has \"/\"\n| where Name has \".\";\nnxDomainDnsEvents\n| where TimeGenerated > ago(endtime)\n// sld = Second Level Domain\n| extend sld = tostring(split(Name, \".\")[-2])\n| summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), dcount(sld), sampleNXDomainList=make_set(Name, 100) by ClientIP\n| where dcount_sld > threshold\n// Filter out previously seen IPs\n// Returns all the records from the left side that don't have matches from the right\n| join kind=leftanti (nxDomainDnsEvents\n | where TimeGenerated between(ago(starttime)..ago(endtime))\n | extend sld = tostring(split(Name, \".\")[-2])\n | summarize dcount(sld) by ClientIP, bin(TimeGenerated,1d)\n | where dcount_sld > threshold\n ) on ClientIP\n | order by dcount_sld desc" + }, + "displayName": "Potential DGA detected", + "detectionAction": { + "alertTemplate": { + "severity": "medium", + "entityMappings": { + "ips": [ + { + "id": "[if(true(), 'ip1', 'ip1')]", + "addressColumn": "ClientIP" + } + ] + }, + "description": "'Identifies clients with a high NXDomain count, which could be indicative of a DGA (cycling through possible C2 domains where most C2s are not live).\nAlerts are generated when a new IP address is seen (based on not being associated with NXDomain records in the prior 10-day baseline period).'", + "tactics": [ + { + "techniques": [ + { + "technique": "T1568" + }, + { + "technique": "T1008" + } + ], + "tactic": "CommandAndControl" + } + ], + "title": "Potential DGA detected" + } + }, + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-dns", + "packageVersion": "3.2.2", + "contentId": "xdr-a0907abe-6925-4d90-af2b-c7e89dc201a6", + "contentVersion": "3.2.1" + } + } + } + } + } + }, + "condition": "[parameters('DeployCustomDetection')]" + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-cd-',uniquestring('xdr-a0907abe-6925-4d90-af2b-c7e89dc201a6')))]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[resourceId('Microsoft.Resources/deployments', 'WindowsServerDNS-CD-xdr-a0907abe-6925-4d90-af2b-c7e89dc201a6')]", + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "'Identifies clients with a high NXDomain count, which could be indicative of a DGA (cycling through possible C2 domains where most C2s are not live).\nAlerts are generated when a new IP address is seen (based on not being associated with NXDomain records in the prior 10-day baseline period).'", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0", + "imports": { + "MicrosoftSecurity": { + "provider": "MicrosoftSecurity", + "version": "1.0.0" + } + }, + "resources": { + "detectionRule": { + "import": "MicrosoftSecurity", + "type": "Microsoft.Security/detectionRules@2026-06-01-preview", + "properties": { + "status": "disabled", + "schedule": { + "frequency": "P1D" + }, + "id": "[if(true(), 'xdr-a0907abe-6925-4d90-af2b-c7e89dc201a6', 'xdr-a0907abe-6925-4d90-af2b-c7e89dc201a6')]", + "queryCondition": { + "queryText": "let starttime = 10d;\nlet endtime = 1d;\nlet threshold = 100;\nlet nxDomainDnsEvents = DnsEvents\n// ResultCode 3 => 'NXDOMAIN'\n| where ResultCode == 3\n| where QueryType in~ (\"A\", \"AAAA\")\n| where ipv4_is_match(\"127.0.0.1\", ClientIP) == False\n| where Name !has \"/\"\n| where Name has \".\";\nnxDomainDnsEvents\n| where TimeGenerated > ago(endtime)\n// sld = Second Level Domain\n| extend sld = tostring(split(Name, \".\")[-2])\n| summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), dcount(sld), sampleNXDomainList=make_set(Name, 100) by ClientIP\n| where dcount_sld > threshold\n// Filter out previously seen IPs\n// Returns all the records from the left side that don't have matches from the right\n| join kind=leftanti (nxDomainDnsEvents\n | where TimeGenerated between(ago(starttime)..ago(endtime))\n | extend sld = tostring(split(Name, \".\")[-2])\n | summarize dcount(sld) by ClientIP, bin(TimeGenerated,1d)\n | where dcount_sld > threshold\n ) on ClientIP\n | order by dcount_sld desc" + }, + "displayName": "Potential DGA detected", + "detectionAction": { + "alertTemplate": { + "severity": "medium", + "entityMappings": { + "ips": [ + { + "id": "[if(true(), 'ip1', 'ip1')]", + "addressColumn": "ClientIP" + } + ] + }, + "description": "'Identifies clients with a high NXDomain count, which could be indicative of a DGA (cycling through possible C2 domains where most C2s are not live).\nAlerts are generated when a new IP address is seen (based on not being associated with NXDomain records in the prior 10-day baseline period).'", + "tactics": [ + { + "techniques": [ + { + "technique": "T1568" + }, + { + "technique": "T1008" + } + ], + "tactic": "CommandAndControl" + } + ], + "title": "Potential DGA detected" + } + }, + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-dns", + "packageVersion": "3.2.2", + "contentId": "xdr-a0907abe-6925-4d90-af2b-c7e89dc201a6", + "contentVersion": "3.2.1" + } + } + } + } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "xdr-a0907abe-6925-4d90-af2b-c7e89dc201a6", + "contentKind": "CustomDetection", + "displayName": "Potential DGA detected", + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-a0907abe-6925-4d90-af2b-c7e89dc201a6','-','3.2.1')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-a0907abe-6925-4d90-af2b-c7e89dc201a6','-','3.2.1')))]", + "version": "3.2.1", + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-dns", + "packageVersion": "3.2.2", + "contentId": "xdr-a0907abe-6925-4d90-af2b-c7e89dc201a6", + "contentVersion": "3.2.1", + "requiredWorkloads": [ + { + "dataTypes": [ + "DnsEvents" + ], + "workload": "sentinel" + } + ], + "requiredDataConnectors": [ + { + "dataTypes": [ + "DnsEvents" + ], + "connectorId": "DNS" + } + ] + } + }, + "condition": "[parameters('DeployCustomDetection')]" + }, + { + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "WindowsServerDNS-CD-xdr-15ae38a2-2e29-48f7-883f-863fb25a5a06", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "mode": "Incremental", + "expressionEvaluationOptions": { + "scope": "inner" + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "imports": { + "MicrosoftSecurity": { + "provider": "MicrosoftSecurity", + "version": "1.0.0" + } + }, + "resources": { + "detectionRule": { + "import": "MicrosoftSecurity", + "type": "Microsoft.Security/detectionRules@2026-06-01-preview", + "properties": { + "status": "disabled", + "schedule": { + "frequency": "P1D" + }, + "id": "[if(true(), 'xdr-15ae38a2-2e29-48f7-883f-863fb25a5a06', 'xdr-15ae38a2-2e29-48f7-883f-863fb25a5a06')]", + "queryCondition": { + "queryText": "let starttime = 8d;\nlet endtime = 1d;\nlet threshold = 10;\nDnsEvents\n| where TimeGenerated > ago(endtime)\n| where Name has \"in-addr.arpa\"\n| summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), dcount(Name), ReverseDNSLookup_List = make_set(Name,100) by ClientIP\n| where dcount_Name > threshold\n| project StartTimeUtc, EndTimeUtc, ClientIP , dcount_Name, ReverseDNSLookup_List\n// Filter out previously seen IPs\n// Returns all the records from the left side that don't have matches from the right\n| join kind=leftanti (DnsEvents\n | where TimeGenerated between(ago(starttime)..ago(endtime))\n | where Name has \"in-addr.arpa\"\n | summarize dcount(Name) by ClientIP, bin(TimeGenerated, 1d)\n | where dcount_Name > threshold\n | project ClientIP , dcount_Name\n) on ClientIP" + }, + "displayName": "Rare client observed with high reverse DNS lookup count", + "detectionAction": { + "alertTemplate": { + "severity": "medium", + "entityMappings": { + "ips": [ + { + "id": "[if(true(), 'ip1', 'ip1')]", + "addressColumn": "ClientIP" + } + ] + }, + "description": "'Identifies clients with a high reverse DNS counts that could be carrying out reconnaissance or discovery activity.\nAlerts are generated if the IP performing such reverse DNS lookups was not seen doing so in the preceding 7-day period.'", + "tactics": [ + { + "techniques": [ + { + "technique": "T1046" + } + ], + "tactic": "Discovery" + } + ], + "title": "Rare client observed with high reverse DNS lookup count" + } + }, + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-dns", + "packageVersion": "3.2.2", + "contentId": "xdr-15ae38a2-2e29-48f7-883f-863fb25a5a06", + "contentVersion": "3.2.1" + } + } + } + } + } + }, + "condition": "[parameters('DeployCustomDetection')]" + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-cd-',uniquestring('xdr-15ae38a2-2e29-48f7-883f-863fb25a5a06')))]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[resourceId('Microsoft.Resources/deployments', 'WindowsServerDNS-CD-xdr-15ae38a2-2e29-48f7-883f-863fb25a5a06')]", + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "'Identifies clients with a high reverse DNS counts that could be carrying out reconnaissance or discovery activity.\nAlerts are generated if the IP performing such reverse DNS lookups was not seen doing so in the preceding 7-day period.'", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0", + "imports": { + "MicrosoftSecurity": { + "provider": "MicrosoftSecurity", + "version": "1.0.0" + } + }, + "resources": { + "detectionRule": { + "import": "MicrosoftSecurity", + "type": "Microsoft.Security/detectionRules@2026-06-01-preview", + "properties": { + "status": "disabled", + "schedule": { + "frequency": "P1D" + }, + "id": "[if(true(), 'xdr-15ae38a2-2e29-48f7-883f-863fb25a5a06', 'xdr-15ae38a2-2e29-48f7-883f-863fb25a5a06')]", + "queryCondition": { + "queryText": "let starttime = 8d;\nlet endtime = 1d;\nlet threshold = 10;\nDnsEvents\n| where TimeGenerated > ago(endtime)\n| where Name has \"in-addr.arpa\"\n| summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), dcount(Name), ReverseDNSLookup_List = make_set(Name,100) by ClientIP\n| where dcount_Name > threshold\n| project StartTimeUtc, EndTimeUtc, ClientIP , dcount_Name, ReverseDNSLookup_List\n// Filter out previously seen IPs\n// Returns all the records from the left side that don't have matches from the right\n| join kind=leftanti (DnsEvents\n | where TimeGenerated between(ago(starttime)..ago(endtime))\n | where Name has \"in-addr.arpa\"\n | summarize dcount(Name) by ClientIP, bin(TimeGenerated, 1d)\n | where dcount_Name > threshold\n | project ClientIP , dcount_Name\n) on ClientIP" + }, + "displayName": "Rare client observed with high reverse DNS lookup count", + "detectionAction": { + "alertTemplate": { + "severity": "medium", + "entityMappings": { + "ips": [ + { + "id": "[if(true(), 'ip1', 'ip1')]", + "addressColumn": "ClientIP" + } + ] + }, + "description": "'Identifies clients with a high reverse DNS counts that could be carrying out reconnaissance or discovery activity.\nAlerts are generated if the IP performing such reverse DNS lookups was not seen doing so in the preceding 7-day period.'", + "tactics": [ + { + "techniques": [ + { + "technique": "T1046" + } + ], + "tactic": "Discovery" + } + ], + "title": "Rare client observed with high reverse DNS lookup count" + } + }, + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-dns", + "packageVersion": "3.2.2", + "contentId": "xdr-15ae38a2-2e29-48f7-883f-863fb25a5a06", + "contentVersion": "3.2.1" + } + } + } + } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "xdr-15ae38a2-2e29-48f7-883f-863fb25a5a06", + "contentKind": "CustomDetection", + "displayName": "Rare client observed with high reverse DNS lookup count", + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-15ae38a2-2e29-48f7-883f-863fb25a5a06','-','3.2.1')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-15ae38a2-2e29-48f7-883f-863fb25a5a06','-','3.2.1')))]", + "version": "3.2.1", + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-dns", + "packageVersion": "3.2.2", + "contentId": "xdr-15ae38a2-2e29-48f7-883f-863fb25a5a06", + "contentVersion": "3.2.1", + "requiredWorkloads": [ + { + "dataTypes": [ + "DnsEvents" + ], + "workload": "sentinel" + } + ], + "requiredDataConnectors": [ + { + "dataTypes": [ + "DnsEvents" + ], + "connectorId": "DNS" + } + ] + } + }, + "condition": "[parameters('DeployCustomDetection')]" + }, + { + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "WindowsServerDNS-CD-xdr-0d76e9cf-788d-4a69-ac7d-f234826b5bed", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "mode": "Incremental", + "expressionEvaluationOptions": { + "scope": "inner" + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "imports": { + "MicrosoftSecurity": { + "provider": "MicrosoftSecurity", + "version": "1.0.0" + } + }, + "resources": { + "detectionRule": { + "import": "MicrosoftSecurity", + "type": "Microsoft.Security/detectionRules@2026-06-01-preview", + "properties": { + "status": "disabled", + "schedule": { + "frequency": "P1D" + }, + "id": "[if(true(), 'xdr-0d76e9cf-788d-4a69-ac7d-f234826b5bed', 'xdr-0d76e9cf-788d-4a69-ac7d-f234826b5bed')]", + "queryCondition": { + "queryText": "DnsEvents\n| where Name contains \".\"\n| where Name has_any (\"monerohash.com\", \"do-dear.com\", \"xmrminerpro.com\", \"secumine.net\", \"xmrpool.com\", \"minexmr.org\", \"hashanywhere.com\",\n\"xmrget.com\", \"mininglottery.eu\", \"minergate.com\", \"moriaxmr.com\", \"multipooler.com\", \"moneropools.com\", \"xmrpool.eu\", \"coolmining.club\",\n\"supportxmr.com\", \"minexmr.com\", \"hashvault.pro\", \"xmrpool.net\", \"crypto-pool.fr\", \"xmr.pt\", \"miner.rocks\", \"walpool.com\", \"herominers.com\",\n\"gntl.co.uk\", \"semipool.com\", \"coinfoundry.org\", \"cryptoknight.cc\", \"fairhash.org\", \"baikalmine.com\", \"tubepool.xyz\", \"fairpool.xyz\", \"asiapool.io\",\n\"coinpoolit.webhop.me\", \"nanopool.org\", \"moneropool.com\", \"miner.center\", \"prohash.net\", \"poolto.be\", \"cryptoescrow.eu\", \"monerominers.net\", \"cryptonotepool.org\",\n\"extrmepool.org\", \"webcoin.me\", \"kippo.eu\", \"hashinvest.ws\", \"monero.farm\", \"supportxmr.com\", \"xmrpool.eu\", \"linux-repository-updates.com\", \"1gh.com\",\n\"dwarfpool.com\", \"hash-to-coins.com\", \"hashvault.pro\", \"pool-proxy.com\", \"hashfor.cash\", \"fairpool.cloud\", \"litecoinpool.org\", \"mineshaft.ml\", \"abcxyz.stream\",\n\"moneropool.ru\", \"cryptonotepool.org.uk\", \"extremepool.org\", \"extremehash.com\", \"hashinvest.net\", \"unipool.pro\", \"crypto-pools.org\", \"monero.net\",\n\"backup-pool.com\", \"mooo.com\", \"freeyy.me\", \"cryptonight.net\", \"shscrypto.net\")\n| extend HostName = iff(Computer has '.', substring(Computer,0,indexof(Computer,'.')),Computer)\n| extend DnsDomain = iff(Computer has '.', substring(Computer,indexof(Computer,'.')+1),\"\")" + }, + "displayName": "DNS events related to mining pools", + "detectionAction": { + "alertTemplate": { + "severity": "low", + "entityMappings": { + "ips": [ + { + "id": "[if(true(), 'ip1', 'ip1')]", + "addressColumn": "ClientIP" + } + ], + "hosts": [ + { + "id": "[if(true(), 'host1', 'host1')]", + "dnsDomainColumn": "DnsDomain", + "nameColumn": "HostName" + } + ] + }, + "description": "'Identifies IP addresses that may be performing DNS lookups associated with common currency mining pools.'", + "tactics": [ + { + "techniques": [ + { + "technique": "T1496" + } + ], + "tactic": "Impact" + } + ], + "title": "DNS events related to mining pools" + } + }, + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-dns", + "packageVersion": "3.2.2", + "contentId": "xdr-0d76e9cf-788d-4a69-ac7d-f234826b5bed", + "contentVersion": "3.2.1" + } + } + } + } + } + }, + "condition": "[parameters('DeployCustomDetection')]" + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-cd-',uniquestring('xdr-0d76e9cf-788d-4a69-ac7d-f234826b5bed')))]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[resourceId('Microsoft.Resources/deployments', 'WindowsServerDNS-CD-xdr-0d76e9cf-788d-4a69-ac7d-f234826b5bed')]", + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "'Identifies IP addresses that may be performing DNS lookups associated with common currency mining pools.'", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0", + "imports": { + "MicrosoftSecurity": { + "provider": "MicrosoftSecurity", + "version": "1.0.0" + } + }, + "resources": { + "detectionRule": { + "import": "MicrosoftSecurity", + "type": "Microsoft.Security/detectionRules@2026-06-01-preview", + "properties": { + "status": "disabled", + "schedule": { + "frequency": "P1D" + }, + "id": "[if(true(), 'xdr-0d76e9cf-788d-4a69-ac7d-f234826b5bed', 'xdr-0d76e9cf-788d-4a69-ac7d-f234826b5bed')]", + "queryCondition": { + "queryText": "DnsEvents\n| where Name contains \".\"\n| where Name has_any (\"monerohash.com\", \"do-dear.com\", \"xmrminerpro.com\", \"secumine.net\", \"xmrpool.com\", \"minexmr.org\", \"hashanywhere.com\",\n\"xmrget.com\", \"mininglottery.eu\", \"minergate.com\", \"moriaxmr.com\", \"multipooler.com\", \"moneropools.com\", \"xmrpool.eu\", \"coolmining.club\",\n\"supportxmr.com\", \"minexmr.com\", \"hashvault.pro\", \"xmrpool.net\", \"crypto-pool.fr\", \"xmr.pt\", \"miner.rocks\", \"walpool.com\", \"herominers.com\",\n\"gntl.co.uk\", \"semipool.com\", \"coinfoundry.org\", \"cryptoknight.cc\", \"fairhash.org\", \"baikalmine.com\", \"tubepool.xyz\", \"fairpool.xyz\", \"asiapool.io\",\n\"coinpoolit.webhop.me\", \"nanopool.org\", \"moneropool.com\", \"miner.center\", \"prohash.net\", \"poolto.be\", \"cryptoescrow.eu\", \"monerominers.net\", \"cryptonotepool.org\",\n\"extrmepool.org\", \"webcoin.me\", \"kippo.eu\", \"hashinvest.ws\", \"monero.farm\", \"supportxmr.com\", \"xmrpool.eu\", \"linux-repository-updates.com\", \"1gh.com\",\n\"dwarfpool.com\", \"hash-to-coins.com\", \"hashvault.pro\", \"pool-proxy.com\", \"hashfor.cash\", \"fairpool.cloud\", \"litecoinpool.org\", \"mineshaft.ml\", \"abcxyz.stream\",\n\"moneropool.ru\", \"cryptonotepool.org.uk\", \"extremepool.org\", \"extremehash.com\", \"hashinvest.net\", \"unipool.pro\", \"crypto-pools.org\", \"monero.net\",\n\"backup-pool.com\", \"mooo.com\", \"freeyy.me\", \"cryptonight.net\", \"shscrypto.net\")\n| extend HostName = iff(Computer has '.', substring(Computer,0,indexof(Computer,'.')),Computer)\n| extend DnsDomain = iff(Computer has '.', substring(Computer,indexof(Computer,'.')+1),\"\")" + }, + "displayName": "DNS events related to mining pools", + "detectionAction": { + "alertTemplate": { + "severity": "low", + "entityMappings": { + "ips": [ + { + "id": "[if(true(), 'ip1', 'ip1')]", + "addressColumn": "ClientIP" + } + ], + "hosts": [ + { + "id": "[if(true(), 'host1', 'host1')]", + "dnsDomainColumn": "DnsDomain", + "nameColumn": "HostName" + } + ] + }, + "description": "'Identifies IP addresses that may be performing DNS lookups associated with common currency mining pools.'", + "tactics": [ + { + "techniques": [ + { + "technique": "T1496" + } + ], + "tactic": "Impact" + } + ], + "title": "DNS events related to mining pools" + } + }, + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-dns", + "packageVersion": "3.2.2", + "contentId": "xdr-0d76e9cf-788d-4a69-ac7d-f234826b5bed", + "contentVersion": "3.2.1" + } + } + } + } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "xdr-0d76e9cf-788d-4a69-ac7d-f234826b5bed", + "contentKind": "CustomDetection", + "displayName": "DNS events related to mining pools", + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-0d76e9cf-788d-4a69-ac7d-f234826b5bed','-','3.2.1')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-0d76e9cf-788d-4a69-ac7d-f234826b5bed','-','3.2.1')))]", + "version": "3.2.1", + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-dns", + "packageVersion": "3.2.2", + "contentId": "xdr-0d76e9cf-788d-4a69-ac7d-f234826b5bed", + "contentVersion": "3.2.1", + "requiredWorkloads": [ + { + "dataTypes": [ + "DnsEvents" + ], + "workload": "sentinel" + } + ], + "requiredDataConnectors": [ + { + "dataTypes": [ + "DnsEvents" + ], + "connectorId": "DNS" + } + ] + } + }, + "condition": "[parameters('DeployCustomDetection')]" + }, + { + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "WindowsServerDNS-CD-xdr-a83ef0f4-dace-4767-bce3-ebd32599d2a0", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "mode": "Incremental", + "expressionEvaluationOptions": { + "scope": "inner" + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "imports": { + "MicrosoftSecurity": { + "provider": "MicrosoftSecurity", + "version": "1.0.0" + } + }, + "resources": { + "detectionRule": { + "import": "MicrosoftSecurity", + "type": "Microsoft.Security/detectionRules@2026-06-01-preview", + "properties": { + "status": "disabled", + "schedule": { + "frequency": "P1D" + }, + "id": "[if(true(), 'xdr-a83ef0f4-dace-4767-bce3-ebd32599d2a0', 'xdr-a83ef0f4-dace-4767-bce3-ebd32599d2a0')]", + "queryCondition": { + "queryText": "DnsEvents\n| where Name contains \".\"\n| where Name has_any (\"tor2web.org\", \"tor2web.com\", \"torlink.co\", \"onion.to\", \"onion.ink\", \"onion.cab\", \"onion.nu\", \"onion.link\",\n\"onion.it\", \"onion.city\", \"onion.direct\", \"onion.top\", \"onion.casa\", \"onion.plus\", \"onion.rip\", \"onion.dog\", \"tor2web.fi\",\n\"tor2web.blutmagie.de\", \"onion.sh\", \"onion.lu\", \"onion.pet\", \"t2w.pw\", \"tor2web.ae.org\", \"tor2web.io\", \"tor2web.xyz\", \"onion.lt\",\n\"s1.tor-gateways.de\", \"s2.tor-gateways.de\", \"s3.tor-gateways.de\", \"s4.tor-gateways.de\", \"s5.tor-gateways.de\", \"hiddenservice.net\")\n| extend HostName = iff(Computer has '.', substring(Computer,0,indexof(Computer,'.')),Computer)\n| extend DnsDomain = iff(Computer has '.', substring(Computer,indexof(Computer,'.')+1),\"\")" + }, + "displayName": "DNS events related to ToR proxies", + "detectionAction": { + "alertTemplate": { + "severity": "low", + "entityMappings": { + "ips": [ + { + "id": "[if(true(), 'ip1', 'ip1')]", + "addressColumn": "ClientIP" + } + ], + "hosts": [ + { + "id": "[if(true(), 'host1', 'host1')]", + "dnsDomainColumn": "DnsDomain", + "nameColumn": "HostName" + } + ] + }, + "description": "'Identifies IP addresses performing DNS lookups associated with common ToR proxies.'", + "tactics": [ + { + "techniques": [ + { + "technique": "T1048" + } + ], + "tactic": "Exfiltration" + } + ], + "title": "DNS events related to ToR proxies" + } + }, + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-dns", + "packageVersion": "3.2.2", + "contentId": "xdr-a83ef0f4-dace-4767-bce3-ebd32599d2a0", + "contentVersion": "3.2.1" + } + } + } + } + } + }, + "condition": "[parameters('DeployCustomDetection')]" + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-cd-',uniquestring('xdr-a83ef0f4-dace-4767-bce3-ebd32599d2a0')))]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[resourceId('Microsoft.Resources/deployments', 'WindowsServerDNS-CD-xdr-a83ef0f4-dace-4767-bce3-ebd32599d2a0')]", + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "'Identifies IP addresses performing DNS lookups associated with common ToR proxies.'", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0", + "imports": { + "MicrosoftSecurity": { + "provider": "MicrosoftSecurity", + "version": "1.0.0" + } + }, + "resources": { + "detectionRule": { + "import": "MicrosoftSecurity", + "type": "Microsoft.Security/detectionRules@2026-06-01-preview", + "properties": { + "status": "disabled", + "schedule": { + "frequency": "P1D" + }, + "id": "[if(true(), 'xdr-a83ef0f4-dace-4767-bce3-ebd32599d2a0', 'xdr-a83ef0f4-dace-4767-bce3-ebd32599d2a0')]", + "queryCondition": { + "queryText": "DnsEvents\n| where Name contains \".\"\n| where Name has_any (\"tor2web.org\", \"tor2web.com\", \"torlink.co\", \"onion.to\", \"onion.ink\", \"onion.cab\", \"onion.nu\", \"onion.link\",\n\"onion.it\", \"onion.city\", \"onion.direct\", \"onion.top\", \"onion.casa\", \"onion.plus\", \"onion.rip\", \"onion.dog\", \"tor2web.fi\",\n\"tor2web.blutmagie.de\", \"onion.sh\", \"onion.lu\", \"onion.pet\", \"t2w.pw\", \"tor2web.ae.org\", \"tor2web.io\", \"tor2web.xyz\", \"onion.lt\",\n\"s1.tor-gateways.de\", \"s2.tor-gateways.de\", \"s3.tor-gateways.de\", \"s4.tor-gateways.de\", \"s5.tor-gateways.de\", \"hiddenservice.net\")\n| extend HostName = iff(Computer has '.', substring(Computer,0,indexof(Computer,'.')),Computer)\n| extend DnsDomain = iff(Computer has '.', substring(Computer,indexof(Computer,'.')+1),\"\")" + }, + "displayName": "DNS events related to ToR proxies", + "detectionAction": { + "alertTemplate": { + "severity": "low", + "entityMappings": { + "ips": [ + { + "id": "[if(true(), 'ip1', 'ip1')]", + "addressColumn": "ClientIP" + } + ], + "hosts": [ + { + "id": "[if(true(), 'host1', 'host1')]", + "dnsDomainColumn": "DnsDomain", + "nameColumn": "HostName" + } + ] + }, + "description": "'Identifies IP addresses performing DNS lookups associated with common ToR proxies.'", + "tactics": [ + { + "techniques": [ + { + "technique": "T1048" + } + ], + "tactic": "Exfiltration" + } + ], + "title": "DNS events related to ToR proxies" + } + }, + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-dns", + "packageVersion": "3.2.2", + "contentId": "xdr-a83ef0f4-dace-4767-bce3-ebd32599d2a0", + "contentVersion": "3.2.1" + } + } + } + } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "xdr-a83ef0f4-dace-4767-bce3-ebd32599d2a0", + "contentKind": "CustomDetection", + "displayName": "DNS events related to ToR proxies", + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-a83ef0f4-dace-4767-bce3-ebd32599d2a0','-','3.2.1')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-a83ef0f4-dace-4767-bce3-ebd32599d2a0','-','3.2.1')))]", + "version": "3.2.1", + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-dns", + "packageVersion": "3.2.2", + "contentId": "xdr-a83ef0f4-dace-4767-bce3-ebd32599d2a0", + "contentVersion": "3.2.1", + "requiredWorkloads": [ + { + "dataTypes": [ + "DnsEvents" + ], + "workload": "sentinel" + } + ], + "requiredDataConnectors": [ + { + "dataTypes": [ + "DnsEvents" + ], + "connectorId": "DNS" + } + ] + } + }, + "condition": "[parameters('DeployCustomDetection')]" + }, + { + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "WindowsServerDNS-CD-xdr-d5b32cd4-2328-43da-ab47-cd289c1f5efc", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "mode": "Incremental", + "expressionEvaluationOptions": { + "scope": "inner" + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "imports": { + "MicrosoftSecurity": { + "provider": "MicrosoftSecurity", + "version": "1.0.0" + } + }, + "resources": { + "detectionRule": { + "import": "MicrosoftSecurity", + "type": "Microsoft.Security/detectionRules@2026-06-01-preview", + "properties": { + "status": "disabled", + "schedule": { + "frequency": "PT5M" + }, + "id": "[if(true(), 'xdr-d5b32cd4-2328-43da-ab47-cd289c1f5efc', 'xdr-d5b32cd4-2328-43da-ab47-cd289c1f5efc')]", + "queryCondition": { + "queryText": "DnsEvents\n| where Name contains \".\"\n| where Name has_any (\"monerohash.com\", \"do-dear.com\", \"xmrminerpro.com\", \"secumine.net\", \"xmrpool.com\", \"minexmr.org\", \"hashanywhere.com\",\n\"xmrget.com\", \"mininglottery.eu\", \"minergate.com\", \"moriaxmr.com\", \"multipooler.com\", \"moneropools.com\", \"xmrpool.eu\", \"coolmining.club\",\n\"supportxmr.com\", \"minexmr.com\", \"hashvault.pro\", \"xmrpool.net\", \"crypto-pool.fr\", \"xmr.pt\", \"miner.rocks\", \"walpool.com\", \"herominers.com\",\n\"gntl.co.uk\", \"semipool.com\", \"coinfoundry.org\", \"cryptoknight.cc\", \"fairhash.org\", \"baikalmine.com\", \"tubepool.xyz\", \"fairpool.xyz\", \"asiapool.io\",\n\"coinpoolit.webhop.me\", \"nanopool.org\", \"moneropool.com\", \"miner.center\", \"prohash.net\", \"poolto.be\", \"cryptoescrow.eu\", \"monerominers.net\", \"cryptonotepool.org\",\n\"extrmepool.org\", \"webcoin.me\", \"kippo.eu\", \"hashinvest.ws\", \"monero.farm\", \"supportxmr.com\", \"xmrpool.eu\", \"linux-repository-updates.com\", \"1gh.com\",\n\"dwarfpool.com\", \"hash-to-coins.com\", \"hashvault.pro\", \"pool-proxy.com\", \"hashfor.cash\", \"fairpool.cloud\", \"litecoinpool.org\", \"mineshaft.ml\", \"abcxyz.stream\",\n\"moneropool.ru\", \"cryptonotepool.org.uk\", \"extremepool.org\", \"extremehash.com\", \"hashinvest.net\", \"unipool.pro\", \"crypto-pools.org\", \"monero.net\",\n\"backup-pool.com\", \"mooo.com\", \"freeyy.me\", \"cryptonight.net\", \"shscrypto.net\")\n| extend HostName = iff(Computer has '.', substring(Computer,0,indexof(Computer,'.')),Computer)\n| extend DnsDomain = iff(Computer has '.', substring(Computer,indexof(Computer,'.')+1),\"\")" + }, + "displayName": "NRT DNS events related to mining pools", + "detectionAction": { + "alertTemplate": { + "severity": "low", + "entityMappings": { + "ips": [ + { + "id": "[if(true(), 'ip1', 'ip1')]", + "addressColumn": "ClientIP" + } + ], + "hosts": [ + { + "id": "[if(true(), 'host1', 'host1')]", + "dnsDomainColumn": "DnsDomain", + "nameColumn": "HostName" + } + ] + }, + "description": "'Identifies IP addresses that may be performing DNS lookups associated with common currency mining pools.'", + "tactics": [ + { + "techniques": [ + { + "technique": "T1496" + } + ], + "tactic": "Impact" + } + ], + "title": "NRT DNS events related to mining pools" + } + }, + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-dns", + "packageVersion": "3.2.2", + "contentId": "xdr-d5b32cd4-2328-43da-ab47-cd289c1f5efc", + "contentVersion": "3.2.1" + } + } + } + } + } + }, + "condition": "[parameters('DeployCustomDetection')]" + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-cd-',uniquestring('xdr-d5b32cd4-2328-43da-ab47-cd289c1f5efc')))]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[resourceId('Microsoft.Resources/deployments', 'WindowsServerDNS-CD-xdr-d5b32cd4-2328-43da-ab47-cd289c1f5efc')]", + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "'Identifies IP addresses that may be performing DNS lookups associated with common currency mining pools.'", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0", + "imports": { + "MicrosoftSecurity": { + "provider": "MicrosoftSecurity", + "version": "1.0.0" + } + }, + "resources": { + "detectionRule": { + "import": "MicrosoftSecurity", + "type": "Microsoft.Security/detectionRules@2026-06-01-preview", + "properties": { + "status": "disabled", + "schedule": { + "frequency": "PT5M" + }, + "id": "[if(true(), 'xdr-d5b32cd4-2328-43da-ab47-cd289c1f5efc', 'xdr-d5b32cd4-2328-43da-ab47-cd289c1f5efc')]", + "queryCondition": { + "queryText": "DnsEvents\n| where Name contains \".\"\n| where Name has_any (\"monerohash.com\", \"do-dear.com\", \"xmrminerpro.com\", \"secumine.net\", \"xmrpool.com\", \"minexmr.org\", \"hashanywhere.com\",\n\"xmrget.com\", \"mininglottery.eu\", \"minergate.com\", \"moriaxmr.com\", \"multipooler.com\", \"moneropools.com\", \"xmrpool.eu\", \"coolmining.club\",\n\"supportxmr.com\", \"minexmr.com\", \"hashvault.pro\", \"xmrpool.net\", \"crypto-pool.fr\", \"xmr.pt\", \"miner.rocks\", \"walpool.com\", \"herominers.com\",\n\"gntl.co.uk\", \"semipool.com\", \"coinfoundry.org\", \"cryptoknight.cc\", \"fairhash.org\", \"baikalmine.com\", \"tubepool.xyz\", \"fairpool.xyz\", \"asiapool.io\",\n\"coinpoolit.webhop.me\", \"nanopool.org\", \"moneropool.com\", \"miner.center\", \"prohash.net\", \"poolto.be\", \"cryptoescrow.eu\", \"monerominers.net\", \"cryptonotepool.org\",\n\"extrmepool.org\", \"webcoin.me\", \"kippo.eu\", \"hashinvest.ws\", \"monero.farm\", \"supportxmr.com\", \"xmrpool.eu\", \"linux-repository-updates.com\", \"1gh.com\",\n\"dwarfpool.com\", \"hash-to-coins.com\", \"hashvault.pro\", \"pool-proxy.com\", \"hashfor.cash\", \"fairpool.cloud\", \"litecoinpool.org\", \"mineshaft.ml\", \"abcxyz.stream\",\n\"moneropool.ru\", \"cryptonotepool.org.uk\", \"extremepool.org\", \"extremehash.com\", \"hashinvest.net\", \"unipool.pro\", \"crypto-pools.org\", \"monero.net\",\n\"backup-pool.com\", \"mooo.com\", \"freeyy.me\", \"cryptonight.net\", \"shscrypto.net\")\n| extend HostName = iff(Computer has '.', substring(Computer,0,indexof(Computer,'.')),Computer)\n| extend DnsDomain = iff(Computer has '.', substring(Computer,indexof(Computer,'.')+1),\"\")" + }, + "displayName": "NRT DNS events related to mining pools", + "detectionAction": { + "alertTemplate": { + "severity": "low", + "entityMappings": { + "ips": [ + { + "id": "[if(true(), 'ip1', 'ip1')]", + "addressColumn": "ClientIP" + } + ], + "hosts": [ + { + "id": "[if(true(), 'host1', 'host1')]", + "dnsDomainColumn": "DnsDomain", + "nameColumn": "HostName" + } + ] + }, + "description": "'Identifies IP addresses that may be performing DNS lookups associated with common currency mining pools.'", + "tactics": [ + { + "techniques": [ + { + "technique": "T1496" + } + ], + "tactic": "Impact" + } + ], + "title": "NRT DNS events related to mining pools" + } + }, + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-dns", + "packageVersion": "3.2.2", + "contentId": "xdr-d5b32cd4-2328-43da-ab47-cd289c1f5efc", + "contentVersion": "3.2.1" + } + } + } + } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "xdr-d5b32cd4-2328-43da-ab47-cd289c1f5efc", + "contentKind": "CustomDetection", + "displayName": "NRT DNS events related to mining pools", + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-d5b32cd4-2328-43da-ab47-cd289c1f5efc','-','3.2.1')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-d5b32cd4-2328-43da-ab47-cd289c1f5efc','-','3.2.1')))]", + "version": "3.2.1", + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-dns", + "packageVersion": "3.2.2", + "contentId": "xdr-d5b32cd4-2328-43da-ab47-cd289c1f5efc", + "contentVersion": "3.2.1", + "requiredWorkloads": [ + { + "dataTypes": [ + "DnsEvents" + ], + "workload": "sentinel" + } + ], + "requiredDataConnectors": [ + { + "dataTypes": [ + "DnsEvents" + ], + "connectorId": "DNS" + } + ] + } + }, + "condition": "[parameters('DeployCustomDetection')]" + }, + { + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "pid-2e4218db-bed8-438a-a490-94dbd06761d1-partnercenter", + "properties": { + "mode": "Incremental", + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "resources": [] + } + } } ], "outputs": {} diff --git a/Solutions/Windows Server DNS/Package/testParameters.json b/Solutions/Windows Server DNS/Package/testParameters.json index 5fd17e01582..a3b1987967b 100644 --- a/Solutions/Windows Server DNS/Package/testParameters.json +++ b/Solutions/Windows Server DNS/Package/testParameters.json @@ -28,5 +28,40 @@ "metadata": { "description": "Name for the workbook" } + }, + "DeployAnalyticsRule": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Deploy the Microsoft Sentinel analytic rules carried by this solution (ContentKind AnalyticsRule and its AnalyticsRuleTemplate registration face)." + } + }, + "DeployWorkbook": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Deploy the Microsoft Sentinel workbook content and its Content Hub registration carried by this solution (ContentKind Workbook and WorkbookTemplate)." + } + }, + "DeployDataConnector": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Deploy the data connectors carried by this solution, together with their metadata and catalog entries (ContentKind DataConnector, ResourceDataConnector and DataType)." + } + }, + "DeployCustomDetection": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Deploy the XDR-native custom detection resources and their Content Hub registrations (ContentKind CustomDetection and CustomDetectionTemplate). Independent of DeployAnalyticsRule: both kinds can be selected together. Existing analytic-rule instances are not disabled or removed. CD enabled or disabled status is controlled separately from this deployment switch." + } + }, + "DeployHuntingQuery": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Deploy the Microsoft Sentinel hunting queries carried by this solution." + } } } diff --git a/Solutions/Windows Server DNS/ReleaseNotes.md b/Solutions/Windows Server DNS/ReleaseNotes.md index b819867fe59..b879fb4b087 100644 --- a/Solutions/Windows Server DNS/ReleaseNotes.md +++ b/Solutions/Windows Server DNS/ReleaseNotes.md @@ -1,4 +1,5 @@ | **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** | |-------------|--------------------------------|--------------------------------------------------------------------| +| 3.2.2 | 20-10-2026 | Added disabled Defender XDR Custom Detections corresponding to the solution's **Analytic Rules**, including the NRT rule. Defender Workbook drafts requiring review are excluded from packaging. | | 3.0.1 | 19-03-2024 | Updated Entity Mappings of **Analytic Rules** | | 3.0.0 | 18-09-2023 | Windows DNS Events via AMA **Data Connector** now General Availability | diff --git a/Solutions/Windows Server DNS/SolutionMetadata.json b/Solutions/Windows Server DNS/SolutionMetadata.json index b4d15a34bea..005959b55b3 100644 --- a/Solutions/Windows Server DNS/SolutionMetadata.json +++ b/Solutions/Windows Server DNS/SolutionMetadata.json @@ -1,7 +1,9 @@ { + "trackingId": "pid-2e4218db-bed8-438a-a490-94dbd06761d1-partnercenter", "publisherId": "azuresentinel", "offerId": "azure-sentinel-solution-dns", "firstPublishDate": "2022-05-11", + "version": "3.2.2", "providers": ["Microsoft"], "categories": { "domains" : ["Networking"] diff --git a/Solutions/Windows Server DNS/XDR Detections/DNS_HighNXDomainCount_detection.yaml b/Solutions/Windows Server DNS/XDR Detections/DNS_HighNXDomainCount_detection.yaml new file mode 100644 index 00000000000..6fa8f293a76 --- /dev/null +++ b/Solutions/Windows Server DNS/XDR Detections/DNS_HighNXDomainCount_detection.yaml @@ -0,0 +1,99 @@ +schemaVersion: 1.0.0 +version: 3.2.1 +kind: CustomDetection +resourceType: Microsoft.Security/detectionRules +apiVersion: 2026-06-01-preview +requiredDataConnectors: +- connectorId: DNS + dataTypes: + - DnsEvents +contentProvenance: + requiredWorkloads: + - workload: sentinel + dataTypes: + - DnsEvents + requiredDataConnectors: + - connectorId: DNS + dataTypes: + - DnsEvents + dependencyReviewRequired: false + source: + platform: Microsoft Sentinel + kind: AnalyticsRule + id: a0907abe-6925-4d90-af2b-c7e89dc201a6 + path: Analytic Rules/DNS_HighNXDomainCount_detection.yaml + version: 1.0.3 + querySha256: 0622eadecb5446af64bf66fdf0258e232d4dfd924acd7eb6737546f00272689e + schedule: + queryFrequency: 1d + queryPeriod: 10d + conversion: + tool: sentinel-to-xdr-migration + version: 0.1.0 + status: converted + reviewRequired: false + reviewReasons: [] + requiredWorkloads: + - sentinel + warnings: + - 'Schedule assessment: source frequency=1d, lookback=10d; target frequency=P1D, native lookback=unknown/unconfigured; + mixed, Sentinel-only, or unknown query surface; no custom lookback is configured in the payload. See https://learn.microsoft.com/en-us/defender-xdr/custom-detection-rules#lookback' + informational: [] + errors: [] + originalTactics: + - CommandAndControl + originalTechniques: + - T1568 + - T1008 + reviewScope: + sourceDocumentSha256: 8003423a63470cd243d5b96c19535e5dd210f143fdf0c22239e839394ca4827f + targetQuerySha256: 7a7fe030d764d8ede9abb3bf000e6252a1a573361aced64213b393a0744eb200 +properties: + id: xdr-a0907abe-6925-4d90-af2b-c7e89dc201a6 + displayName: Potential DGA detected + status: disabled + queryCondition: + queryText: |- + let starttime = 10d; + let endtime = 1d; + let threshold = 100; + let nxDomainDnsEvents = DnsEvents + // ResultCode 3 => 'NXDOMAIN' + | where ResultCode == 3 + | where QueryType in~ ("A", "AAAA") + | where ipv4_is_match("127.0.0.1", ClientIP) == False + | where Name !has "/" + | where Name has "."; + nxDomainDnsEvents + | where TimeGenerated > ago(endtime) + // sld = Second Level Domain + | extend sld = tostring(split(Name, ".")[-2]) + | summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), dcount(sld), sampleNXDomainList=make_set(Name, 100) by ClientIP + | where dcount_sld > threshold + // Filter out previously seen IPs + // Returns all the records from the left side that don't have matches from the right + | join kind=leftanti (nxDomainDnsEvents + | where TimeGenerated between(ago(starttime)..ago(endtime)) + | extend sld = tostring(split(Name, ".")[-2]) + | summarize dcount(sld) by ClientIP, bin(TimeGenerated,1d) + | where dcount_sld > threshold + ) on ClientIP + | order by dcount_sld desc + schedule: + frequency: P1D + detectionAction: + alertTemplate: + title: Potential DGA detected + description: |- + 'Identifies clients with a high NXDomain count, which could be indicative of a DGA (cycling through possible C2 domains where most C2s are not live). + Alerts are generated when a new IP address is seen (based on not being associated with NXDomain records in the prior 10-day baseline period).' + severity: medium + entityMappings: + ips: + - id: ip1 + addressColumn: ClientIP + tactics: + - tactic: CommandAndControl + techniques: + - technique: T1568 + - technique: T1008 diff --git a/Solutions/Windows Server DNS/XDR Detections/DNS_HighReverseDNSCount_detection.yaml b/Solutions/Windows Server DNS/XDR Detections/DNS_HighReverseDNSCount_detection.yaml new file mode 100644 index 00000000000..2bbfe5912f8 --- /dev/null +++ b/Solutions/Windows Server DNS/XDR Detections/DNS_HighReverseDNSCount_detection.yaml @@ -0,0 +1,90 @@ +schemaVersion: 1.0.0 +version: 3.2.1 +kind: CustomDetection +resourceType: Microsoft.Security/detectionRules +apiVersion: 2026-06-01-preview +requiredDataConnectors: +- connectorId: DNS + dataTypes: + - DnsEvents +contentProvenance: + requiredWorkloads: + - workload: sentinel + dataTypes: + - DnsEvents + requiredDataConnectors: + - connectorId: DNS + dataTypes: + - DnsEvents + dependencyReviewRequired: false + source: + platform: Microsoft Sentinel + kind: AnalyticsRule + id: 15ae38a2-2e29-48f7-883f-863fb25a5a06 + path: Analytic Rules/DNS_HighReverseDNSCount_detection.yaml + version: 1.0.2 + querySha256: 8e7021add8eea1f0b013e7c629906d9018a7b7610929729a50f96881d12d78ec + schedule: + queryFrequency: 1d + queryPeriod: 8d + conversion: + tool: sentinel-to-xdr-migration + version: 0.1.0 + status: converted + reviewRequired: false + reviewReasons: [] + requiredWorkloads: + - sentinel + warnings: + - 'Schedule assessment: source frequency=1d, lookback=8d; target frequency=P1D, native lookback=unknown/unconfigured; + mixed, Sentinel-only, or unknown query surface; no custom lookback is configured in the payload. See https://learn.microsoft.com/en-us/defender-xdr/custom-detection-rules#lookback' + informational: [] + errors: [] + originalTactics: + - Discovery + originalTechniques: + - T1046 + reviewScope: + sourceDocumentSha256: 080129a727eb2ef9c3028ebb2cc514e064b8c897f6ac91e5d24c21fd0d95d646 + targetQuerySha256: 4ba26136b0e06ffa7b4a765556b78f85a9a643737b0e2b10d0af0393a838d2be +properties: + id: xdr-15ae38a2-2e29-48f7-883f-863fb25a5a06 + displayName: Rare client observed with high reverse DNS lookup count + status: disabled + queryCondition: + queryText: |- + let starttime = 8d; + let endtime = 1d; + let threshold = 10; + DnsEvents + | where TimeGenerated > ago(endtime) + | where Name has "in-addr.arpa" + | summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), dcount(Name), ReverseDNSLookup_List = make_set(Name,100) by ClientIP + | where dcount_Name > threshold + | project StartTimeUtc, EndTimeUtc, ClientIP , dcount_Name, ReverseDNSLookup_List + // Filter out previously seen IPs + // Returns all the records from the left side that don't have matches from the right + | join kind=leftanti (DnsEvents + | where TimeGenerated between(ago(starttime)..ago(endtime)) + | where Name has "in-addr.arpa" + | summarize dcount(Name) by ClientIP, bin(TimeGenerated, 1d) + | where dcount_Name > threshold + | project ClientIP , dcount_Name + ) on ClientIP + schedule: + frequency: P1D + detectionAction: + alertTemplate: + title: Rare client observed with high reverse DNS lookup count + description: |- + 'Identifies clients with a high reverse DNS counts that could be carrying out reconnaissance or discovery activity. + Alerts are generated if the IP performing such reverse DNS lookups was not seen doing so in the preceding 7-day period.' + severity: medium + entityMappings: + ips: + - id: ip1 + addressColumn: ClientIP + tactics: + - tactic: Discovery + techniques: + - technique: T1046 diff --git a/Solutions/Windows Server DNS/XDR Detections/DNS_Miners.yaml b/Solutions/Windows Server DNS/XDR Detections/DNS_Miners.yaml new file mode 100644 index 00000000000..f6acd418317 --- /dev/null +++ b/Solutions/Windows Server DNS/XDR Detections/DNS_Miners.yaml @@ -0,0 +1,89 @@ +schemaVersion: 1.0.0 +version: 3.2.1 +kind: CustomDetection +resourceType: Microsoft.Security/detectionRules +apiVersion: 2026-06-01-preview +requiredDataConnectors: +- connectorId: DNS + dataTypes: + - DnsEvents +contentProvenance: + requiredWorkloads: + - workload: sentinel + dataTypes: + - DnsEvents + requiredDataConnectors: + - connectorId: DNS + dataTypes: + - DnsEvents + dependencyReviewRequired: false + source: + platform: Microsoft Sentinel + kind: AnalyticsRule + id: 0d76e9cf-788d-4a69-ac7d-f234826b5bed + path: Analytic Rules/DNS_Miners.yaml + version: 1.0.3 + querySha256: 89963454c2b89b7c539c86e7185dfc3d835314ed6afaf74ec985f7812328bb09 + schedule: + queryFrequency: 1d + queryPeriod: 1d + conversion: + tool: sentinel-to-xdr-migration + version: 0.1.0 + status: converted + reviewRequired: false + reviewReasons: [] + requiredWorkloads: + - sentinel + warnings: + - 'Schedule assessment: source frequency=1d, lookback=1d; target frequency=P1D, native lookback=unknown/unconfigured; + mixed, Sentinel-only, or unknown query surface; no custom lookback is configured in the payload. See https://learn.microsoft.com/en-us/defender-xdr/custom-detection-rules#lookback' + informational: + - Host.FullName `Computer` is safely represented by retained nameColumn `HostName` and dnsDomainColumn `DnsDomain`; the + query explicitly decomposes that same full name. No fullNameColumn is emitted + errors: [] + originalTactics: + - Impact + originalTechniques: + - T1496 + reviewScope: + sourceDocumentSha256: 5460ea90e5c301b86503942d4be18798391bbd387b0f7f740dfcae50fc6b9e25 + targetQuerySha256: 8ddd0a6aab7b19b0b1348888677546d86e89fcf9d34144d8e5155707664afe96 +properties: + id: xdr-0d76e9cf-788d-4a69-ac7d-f234826b5bed + displayName: DNS events related to mining pools + status: disabled + queryCondition: + queryText: |- + DnsEvents + | where Name contains "." + | where Name has_any ("monerohash.com", "do-dear.com", "xmrminerpro.com", "secumine.net", "xmrpool.com", "minexmr.org", "hashanywhere.com", + "xmrget.com", "mininglottery.eu", "minergate.com", "moriaxmr.com", "multipooler.com", "moneropools.com", "xmrpool.eu", "coolmining.club", + "supportxmr.com", "minexmr.com", "hashvault.pro", "xmrpool.net", "crypto-pool.fr", "xmr.pt", "miner.rocks", "walpool.com", "herominers.com", + "gntl.co.uk", "semipool.com", "coinfoundry.org", "cryptoknight.cc", "fairhash.org", "baikalmine.com", "tubepool.xyz", "fairpool.xyz", "asiapool.io", + "coinpoolit.webhop.me", "nanopool.org", "moneropool.com", "miner.center", "prohash.net", "poolto.be", "cryptoescrow.eu", "monerominers.net", "cryptonotepool.org", + "extrmepool.org", "webcoin.me", "kippo.eu", "hashinvest.ws", "monero.farm", "supportxmr.com", "xmrpool.eu", "linux-repository-updates.com", "1gh.com", + "dwarfpool.com", "hash-to-coins.com", "hashvault.pro", "pool-proxy.com", "hashfor.cash", "fairpool.cloud", "litecoinpool.org", "mineshaft.ml", "abcxyz.stream", + "moneropool.ru", "cryptonotepool.org.uk", "extremepool.org", "extremehash.com", "hashinvest.net", "unipool.pro", "crypto-pools.org", "monero.net", + "backup-pool.com", "mooo.com", "freeyy.me", "cryptonight.net", "shscrypto.net") + | extend HostName = iff(Computer has '.', substring(Computer,0,indexof(Computer,'.')),Computer) + | extend DnsDomain = iff(Computer has '.', substring(Computer,indexof(Computer,'.')+1),"") + schedule: + frequency: P1D + detectionAction: + alertTemplate: + title: DNS events related to mining pools + description: '''Identifies IP addresses that may be performing DNS lookups associated with common currency mining pools.''' + severity: low + entityMappings: + hosts: + - id: host1 + nameColumn: HostName + dnsDomainColumn: DnsDomain + ips: + - id: ip1 + addressColumn: ClientIP + tactics: + - tactic: Impact + techniques: + - technique: T1496 diff --git a/Solutions/Windows Server DNS/XDR Detections/DNS_TorProxies.yaml b/Solutions/Windows Server DNS/XDR Detections/DNS_TorProxies.yaml new file mode 100644 index 00000000000..8e2beadf255 --- /dev/null +++ b/Solutions/Windows Server DNS/XDR Detections/DNS_TorProxies.yaml @@ -0,0 +1,84 @@ +schemaVersion: 1.0.0 +version: 3.2.1 +kind: CustomDetection +resourceType: Microsoft.Security/detectionRules +apiVersion: 2026-06-01-preview +requiredDataConnectors: +- connectorId: DNS + dataTypes: + - DnsEvents +contentProvenance: + requiredWorkloads: + - workload: sentinel + dataTypes: + - DnsEvents + requiredDataConnectors: + - connectorId: DNS + dataTypes: + - DnsEvents + dependencyReviewRequired: false + source: + platform: Microsoft Sentinel + kind: AnalyticsRule + id: a83ef0f4-dace-4767-bce3-ebd32599d2a0 + path: Analytic Rules/DNS_TorProxies.yaml + version: 1.0.3 + querySha256: 26e3426bf4d2a7d0c18772eabc1b42bfa84364aa7ab015e12ef84065f8479113 + schedule: + queryFrequency: 1d + queryPeriod: 1d + conversion: + tool: sentinel-to-xdr-migration + version: 0.1.0 + status: converted + reviewRequired: false + reviewReasons: [] + requiredWorkloads: + - sentinel + warnings: + - 'Schedule assessment: source frequency=1d, lookback=1d; target frequency=P1D, native lookback=unknown/unconfigured; + mixed, Sentinel-only, or unknown query surface; no custom lookback is configured in the payload. See https://learn.microsoft.com/en-us/defender-xdr/custom-detection-rules#lookback' + informational: + - Host.FullName `Computer` is safely represented by retained nameColumn `HostName` and dnsDomainColumn `DnsDomain`; the + query explicitly decomposes that same full name. No fullNameColumn is emitted + errors: [] + originalTactics: + - Exfiltration + originalTechniques: + - T1048 + reviewScope: + sourceDocumentSha256: c3fc78e65ba030a56b6fd0fc8f210d6d3af71d246b80ba066d81d9e808bb7d5a + targetQuerySha256: 1795f06146c569b146080766faedb7ec433a717413e7c8e49d333b06032ebd56 +properties: + id: xdr-a83ef0f4-dace-4767-bce3-ebd32599d2a0 + displayName: DNS events related to ToR proxies + status: disabled + queryCondition: + queryText: |- + DnsEvents + | where Name contains "." + | where Name has_any ("tor2web.org", "tor2web.com", "torlink.co", "onion.to", "onion.ink", "onion.cab", "onion.nu", "onion.link", + "onion.it", "onion.city", "onion.direct", "onion.top", "onion.casa", "onion.plus", "onion.rip", "onion.dog", "tor2web.fi", + "tor2web.blutmagie.de", "onion.sh", "onion.lu", "onion.pet", "t2w.pw", "tor2web.ae.org", "tor2web.io", "tor2web.xyz", "onion.lt", + "s1.tor-gateways.de", "s2.tor-gateways.de", "s3.tor-gateways.de", "s4.tor-gateways.de", "s5.tor-gateways.de", "hiddenservice.net") + | extend HostName = iff(Computer has '.', substring(Computer,0,indexof(Computer,'.')),Computer) + | extend DnsDomain = iff(Computer has '.', substring(Computer,indexof(Computer,'.')+1),"") + schedule: + frequency: P1D + detectionAction: + alertTemplate: + title: DNS events related to ToR proxies + description: '''Identifies IP addresses performing DNS lookups associated with common ToR proxies.''' + severity: low + entityMappings: + hosts: + - id: host1 + nameColumn: HostName + dnsDomainColumn: DnsDomain + ips: + - id: ip1 + addressColumn: ClientIP + tactics: + - tactic: Exfiltration + techniques: + - technique: T1048 diff --git a/Solutions/Windows Server DNS/XDR Detections/NRT_DNS_Related_To_Mining_Pools.yaml b/Solutions/Windows Server DNS/XDR Detections/NRT_DNS_Related_To_Mining_Pools.yaml new file mode 100644 index 00000000000..1d69ed31a45 --- /dev/null +++ b/Solutions/Windows Server DNS/XDR Detections/NRT_DNS_Related_To_Mining_Pools.yaml @@ -0,0 +1,89 @@ +schemaVersion: 1.0.0 +version: 3.2.1 +kind: CustomDetection +resourceType: Microsoft.Security/detectionRules +apiVersion: 2026-06-01-preview +requiredDataConnectors: +- connectorId: DNS + dataTypes: + - DnsEvents +contentProvenance: + requiredWorkloads: + - workload: sentinel + dataTypes: + - DnsEvents + requiredDataConnectors: + - connectorId: DNS + dataTypes: + - DnsEvents + dependencyReviewRequired: false + source: + platform: Microsoft Sentinel + kind: AnalyticsRule + id: d5b32cd4-2328-43da-ab47-cd289c1f5efc + path: Analytic Rules/NRT_DNS_Related_To_Mining_Pools.yaml + version: 1.0.2 + querySha256: 89963454c2b89b7c539c86e7185dfc3d835314ed6afaf74ec985f7812328bb09 + schedule: + queryFrequency: '' + queryPeriod: '' + conversion: + tool: sentinel-to-xdr-migration + version: 0.1.0 + status: converted + reviewRequired: false + reviewReasons: [] + requiredWorkloads: + - sentinel + warnings: + - 'Schedule assessment: source frequency=unknown, lookback=unknown; target frequency=PT5M, native lookback=unknown/unconfigured; + source NRT timing is not preserved by the emitted scheduled frequency. See https://learn.microsoft.com/en-us/defender-xdr/custom-detection-rules#lookback' + informational: + - Host.FullName `Computer` is safely represented by retained nameColumn `HostName` and dnsDomainColumn `DnsDomain`; the + query explicitly decomposes that same full name. No fullNameColumn is emitted + errors: [] + originalTactics: + - Impact + originalTechniques: + - T1496 + reviewScope: + sourceDocumentSha256: d94b658ee4c0177fd98010233135dbae895b03da9223daec419317ce1c3a6030 + targetQuerySha256: 8ddd0a6aab7b19b0b1348888677546d86e89fcf9d34144d8e5155707664afe96 +properties: + id: xdr-d5b32cd4-2328-43da-ab47-cd289c1f5efc + displayName: NRT DNS events related to mining pools + status: disabled + queryCondition: + queryText: |- + DnsEvents + | where Name contains "." + | where Name has_any ("monerohash.com", "do-dear.com", "xmrminerpro.com", "secumine.net", "xmrpool.com", "minexmr.org", "hashanywhere.com", + "xmrget.com", "mininglottery.eu", "minergate.com", "moriaxmr.com", "multipooler.com", "moneropools.com", "xmrpool.eu", "coolmining.club", + "supportxmr.com", "minexmr.com", "hashvault.pro", "xmrpool.net", "crypto-pool.fr", "xmr.pt", "miner.rocks", "walpool.com", "herominers.com", + "gntl.co.uk", "semipool.com", "coinfoundry.org", "cryptoknight.cc", "fairhash.org", "baikalmine.com", "tubepool.xyz", "fairpool.xyz", "asiapool.io", + "coinpoolit.webhop.me", "nanopool.org", "moneropool.com", "miner.center", "prohash.net", "poolto.be", "cryptoescrow.eu", "monerominers.net", "cryptonotepool.org", + "extrmepool.org", "webcoin.me", "kippo.eu", "hashinvest.ws", "monero.farm", "supportxmr.com", "xmrpool.eu", "linux-repository-updates.com", "1gh.com", + "dwarfpool.com", "hash-to-coins.com", "hashvault.pro", "pool-proxy.com", "hashfor.cash", "fairpool.cloud", "litecoinpool.org", "mineshaft.ml", "abcxyz.stream", + "moneropool.ru", "cryptonotepool.org.uk", "extremepool.org", "extremehash.com", "hashinvest.net", "unipool.pro", "crypto-pools.org", "monero.net", + "backup-pool.com", "mooo.com", "freeyy.me", "cryptonight.net", "shscrypto.net") + | extend HostName = iff(Computer has '.', substring(Computer,0,indexof(Computer,'.')),Computer) + | extend DnsDomain = iff(Computer has '.', substring(Computer,indexof(Computer,'.')+1),"") + schedule: + frequency: PT5M + detectionAction: + alertTemplate: + title: NRT DNS events related to mining pools + description: '''Identifies IP addresses that may be performing DNS lookups associated with common currency mining pools.''' + severity: low + entityMappings: + hosts: + - id: host1 + nameColumn: HostName + dnsDomainColumn: DnsDomain + ips: + - id: ip1 + addressColumn: ClientIP + tactics: + - tactic: Impact + techniques: + - technique: T1496