From 5d1054e2fd353ae25647aa891f08a60e27320eb2 Mon Sep 17 00:00:00 2001 From: Alon Karmona Date: Tue, 20 Oct 2026 14:49:43 +0300 Subject: [PATCH] Migrate Windows Server DNS (3.2.2) to Defender XDR Custom Detections (V3.1) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 9f05623b-293a-427c-a28f-23d9b3fcc32c --- .../Windows Server DNS/Data/Solution_DNS.json | 10 +- .../Windows Server DNS/Package/3.2.2.zip | Bin 0 -> 27810 bytes .../Package/createUiDefinition.json | 70 +- .../Package/mainTemplate.json | 1144 ++++++++++++++++- .../Package/testParameters.json | 35 + Solutions/Windows Server DNS/ReleaseNotes.md | 1 + .../Windows Server DNS/SolutionMetadata.json | 2 + .../DNS_HighNXDomainCount_detection.yaml | 99 ++ .../DNS_HighReverseDNSCount_detection.yaml | 90 ++ .../XDR Detections/DNS_Miners.yaml | 89 ++ .../XDR Detections/DNS_TorProxies.yaml | 84 ++ .../NRT_DNS_Related_To_Mining_Pools.yaml | 89 ++ 12 files changed, 1642 insertions(+), 71 deletions(-) create mode 100644 Solutions/Windows Server DNS/Package/3.2.2.zip create mode 100644 Solutions/Windows Server DNS/XDR Detections/DNS_HighNXDomainCount_detection.yaml create mode 100644 Solutions/Windows Server DNS/XDR Detections/DNS_HighReverseDNSCount_detection.yaml create mode 100644 Solutions/Windows Server DNS/XDR Detections/DNS_Miners.yaml create mode 100644 Solutions/Windows Server DNS/XDR Detections/DNS_TorProxies.yaml create mode 100644 Solutions/Windows Server DNS/XDR Detections/NRT_DNS_Related_To_Mining_Pools.yaml diff --git a/Solutions/Windows Server DNS/Data/Solution_DNS.json b/Solutions/Windows Server DNS/Data/Solution_DNS.json index 5de058eba79..84392bfcc65 100644 --- a/Solutions/Windows Server DNS/Data/Solution_DNS.json +++ b/Solutions/Windows Server DNS/Data/Solution_DNS.json @@ -29,11 +29,19 @@ "Hunting Queries/Solorigate-Encoded-Domain-URL.yaml" ], "BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\Windows Server DNS", - "Version": "3.0.1", + "Version": "3.2.2", "Metadata": "SolutionMetadata.json", "TemplateSpec": true, "StaticDataConnectorIds": [ "ASimDnsActivityLogs", "DNS" + ], + "XDR Workbooks": [], + "XDR Detections": [ + "XDR Detections/DNS_HighNXDomainCount_detection.yaml", + "XDR Detections/DNS_HighReverseDNSCount_detection.yaml", + "XDR Detections/DNS_Miners.yaml", + "XDR Detections/DNS_TorProxies.yaml", + "XDR Detections/NRT_DNS_Related_To_Mining_Pools.yaml" ] } diff --git a/Solutions/Windows Server DNS/Package/3.2.2.zip b/Solutions/Windows Server DNS/Package/3.2.2.zip new file mode 100644 index 0000000000000000000000000000000000000000..5dc973342e41f8e234ce20d15f5f920b34660fdb GIT binary patch literal 27810 zcmV)$K#spqO9KQH000080Hk$PT_tU!vl$Wq0O3{u02crN0Aq4xVRU6xX+&jaX>MtB zX>V>WYIARH?Of|_8#$K#-$1{^fp!O$3|(v|>5DPxf!oS-f^|Gu+ui9!6f~%+qY~Fu zWHrf>tn>t!XW2*FCs~|BR;fyo9lImvhW(Mis$!9chu^uA{NwAd09yZUqbX*hbqKAg zbGbbn4E&RRCX`4pL*@G7O<}Mf=`6gngT4NK|Dcx}oJpJyjtvTjKR+AdL@Mc|R{iHi z>f|q3|G%wP|JLgASW}_m6b+5_Tt-G)J#qab?z`4QXgot>rB>9qF<5w=3nMagXl&~c z{-8$ytw^hhOqLG-TGGChZ-j|khcFST#cuUxEUb)bU-QElZDeHb!pMJ>SpwEXk4F`E zjF|Tm>88cFuxKK!9C3(v!!z;!_s&r{sW2U6!a6jA6P;)~7@nT@?JOC!U@l`feLQM? z`zXH}wP1=enY!xt4QD;)X(eoqd!3A~FYztFNb0R%Vkj5%0sYvFD zEp%bvL?>_*rf=b;HkURR5kg^0SSy?ZV-cQfC252snou83P#6UnEvgvn!qot;b_Gr;XCOZAv`WTFKmZ6GmMS!$0B=#Ja?CBF9N9th7 z$rDUOvqsr;pRyP zbO}b3p472ItHon3CskOqOw9%|U_O=66r>F+>on<$7;}S>Ae4_6u)BLyB=BIr3kQ1# z54*d&EIn>oSg=!Fq(KzMmB?cZb5=iuU1>pS2e!y_Z5+ld9=p5E#j>P|54y0sOI#dl zeaTPu=}Ad3oE0hZ<45%P*Wnoq(P6|Yt9tyjAp9iop9LD}n}1IuzFGtEy11`tMuudG z$PWAy)_bWm^vxevx;55O$D7$;6>TxDo5h;J1ZWwwx-b#GFnT6qZ;)TrTR`31|074k zn6S?)|6)*$Tp#ti4@LS+Su&S)FfZY32YEUAK%{6Kufq+!HM-!nyrJ=lPGrO_C#17m z^@gvPKi<|^mg-1sWLJhxkVLP(Apc0lF|yzBRK^65vXd^%5fXGDo!90pw>qh8g@uY0 z4eIJ7kxwP99H&_NLf4R9F6d827x^0fY`30VN!C2ALvW_3cU1lv{wOTZ`3 z8Bx_r(48DrN~(cDx5&B4a#<=^_m50=l*?nSoY86XE3MNDNwa9NE}h7fd`40kOYnf3 z3I|AYBE3q?JqtVlW&&9B2DQ<5q*ct$F7^H@VGq`{Q&fqYwi`@rcltELPIs^Ky3vKf z-wU*E6G*0-eAd=aPcE9sY~{jDdBjMoNVs-gINP1RjJrEEX}GNb{Y~Vu7kuu=2YUy5 zy}j>xd;2?`*R4&f+r4QO=eJzIW1VGM^@m31Lp@iG)~Og{O3gQ;Ax}kwQ=P^>oH*z8 z0Z|i!n@|uNoyX*DvZs^My0dwxzOEs{-VqYk86lOkn*|5sUqo6Uy=}e9MBes*YX!D>bb?ZCzVkSc}-dF*#d zXPZwiFw0ZnC<;p?Nr;b(M1-CG4F>CGu9t4u_8ER{&)ej6>3Og`6Cz8_l?Z)WjGO$r z-Ex$~bARQJasl3h-Q*2d&hYkmeslMKn(-^K>$N;2&6%K^qJg<|Q~FjKD4jLtWh9&+ zrwf%Mx4p^r2Kn8}STr7UFZASMk-yJM92eHNG^wzx&AgT4`Tl z)bhvc+j+R86P8M4v!k(+J!muDckPvE^MIk|t&QJ%?BB_6vG}SMJADN9&eP zb9}Mp)%xyejMBF*qp~v5;?p`SIV{SFmPsq0E2jKVAO1@hEN&F*uD>r;1}S0gP%59~ zy2iS)58a2Oi9>T;e!NRmO=LnzLDCvtB7=N2i5@R%S@)!nG08a5;4>LZb4+>mCc+vR zyRBq4m-68Mm-0(l%3dnf<-vVRB@MFaMO{a&r3wR)#1>{*u*jL5S&Wd_tdas#WSbuGc@kwaW4B>Nwzlc=EWoD0p$pAP4;x)O%R<5mU zemB&ro~V0!y=~Y`;a#mlMcIc}B6iIll*F`chjRH;&)_mxBDkpGQ&YZ#L0ok_S!Wit zx)w?5hDz8w)Pr@xxLW0-iootq@Ry8dar~r2emg?#3a5<}X)p67wH{ey7V*1@_MOg7+OB)`%em^r( z)mb*1kt%lFiW%8B*n66h%@p3%j8v3;3TC9a3#O5|1Q&vR`)-$!%Qkg?aU}C&*jFM(@!nu`H(j0ucRKQdwQ#k!~=(TmE3+1|D=SIXE zFnI4pEUBVBL$VBlnbeLJQIJcci)0G9wpEH%M_uV`Lp-t&XJsm?l-thPJhsxT*x^Mrs55 zd%c*pt_h2&R7ji9q>fk8x*O2>PV00h^d4*xy=T06jF%PknD@5@PVnLyr225V*Gyj) zxnJh3!+Ue8;}d{)odZ1euyvpUIOQ7`1SRrw2sKIxX)R|Le2zELGc*ejk&`p&7T1AS zP8ey=UJ$Ivfuc@r5p7xp3v&@RFcGq2&29A(tr#J1C;65E>v8&lVftXZ4twxGfjv`B z$wTJ%f96`JcI$|I@F^g&;TbdT!q(XuMCzzmRcEv{kE)1;F{q+NgJT~U4iE1g4j1|i za-**#ZXXQ~KRGnq4FNUYeBgC|w8eElJ-dL9pb8#+a*O}Tse(I)*P(0|vH_c8?3GQk zHUie0~cFPhgNEXu;5iix&T23o?^H-8E#LhHYV}W6zjRp5S-2-#Tlkm(AlP`cGxlJ z3fYnqE7~*@>6}^-y95}a5{_?2%Al~cSEUD1MQOoK_*BmUg#7B9d*Kr%TCt5=Debn0%0BTf!3)~p zN*QmsAYOGojIUG2^fse&nrpA*n@~CvDdo#UBrX+YGA-VVXnwqaoOc+}(tFt=!-Nx^ z#?^djby+&~q~uMhy>c{VHlvmR^7ajb@8f_%;z(z?Fy49eyHzBK`3w!Av;2Y&pc2dH zh?iyYgG4GXvwrCUq<7L5fL9S(uE97XCKDM^=K>NrLscE@SVG`OIf#8w1j@L{u{^@0nx@wl6yN29$V(9Nh zn)EiqF^C_M+$o_cJ z`p&A^`c)B*{8%~&zZb$dnR41F@<&iay0GMqr-?SwO|#D(pxewiKHXRYqU|$N zZMRnjYmom*0d;-u?@{^s%z^dI7J+p%Rh|ZeXJu~gUXb<8M?)6n5d10W zpw>>$!}61_peGLbybUK4SOIFo;mvZ}SPesqTt=b{YJesh`u1ASPPO5E2uQ9_J@dd# z{ji+ZBHw`VhF5f+HXOMl&!$j{D*Q>4JO*T z$HH$wr6>))c{q4*0O%rri%U}&$Vsu4&l2+dRW`~^g@XM@dk{^95fPtir{I?---ltr zc_aa;X19o{`I3$#`OzzwIn8;kLJ^~pZ|KO4jxa6^<8fJ%=1*$OqkCX@Z+$o)l^Z=y zk#_n;>{kg;MK&fOoq)gFr=o!-fmf6fBgR+fnRwcLIEwwTddebkK$~$UNuhVj2pVy4 z(D*a%iO#KegZ^MOkeDMXA3i?`GHI|CY4$;}qQa(6%@|h$2yDcL8 zobD=;39+B1{X#g0=6+E8-A6<5No6Alq!b|Jex4<6%Y5-l$)d&_+FNa6e>d8M4%7N< zUbXcuoQC$9#M1JX!+h>4_51q)+>>DHgZxSbKcAi43-rGK1fWMwMxsmY=y#z>6>eHP z8itGM@*IUBkPsYePG9L3RX`&Y^Fx1mn?LSDFB+hYIFZy;m!)bP(}*jDS*?0*iamd2 z;DBzp8SEbn_8$!VW@I$BmmAI7lzl$AM+dR77cIu*067s|+QBW*&a*z^qT5g!hWz3N z5jdBLlInywv~_9Nv=3wDVijGuyl7rlv%J2iSG&Zj^=cxGb?rZSXN^#C`#tWh>EiE& zNNxEAUp!L|Uy)0f&@?W%;Y(`DIW#V)sbA04dR6{tH<~Q35~4O6Myog8bWsa^#uwML zcUG^a+3EB*e6ikPbrH#J`YIc*cQb60001OVQFquWo>Y5 zVRU6KYIARH?Y;YU+c=gt`v0so?|{*Kb8Od$y33bzIj7xmRhL&MDSxr6yJwZMJP-*< zh$(;pNXx34`qp`t^JwQu&e{M-f)puHwiDYiGt({`#C2oi_S?7L|Mg!GYWy$h&d3}$ zUZKV;3{QE=yq6v*qW3|d^^vx4;YjXYS za^~W2cjp6{D)!(=GcS@c$Ha3Zk>emqfGdD~V0>|Bkt9BG;kTV;$~C(?@%Np*y^ov6 zo*D9*k(F~>r6K<#ZVxd$*X!UdpQ00n{bfj9i54>=2uj!41z{m&#E0pXB#eT!Lm6{^ z-F2YqyG=>(&Fdn3;Fa9GY+C~zc;t;>#j1f0f=hj!I6J!R0 z==RIGrins6CE<(+w4mV(%2I*i=G4$#9AckO5n-XAL}rPU8DJ9Y{q?=%0-iLPoJpJG>9MT(tT-6!m#l5i(0~nO1RvDk=NR=Cysvwt^ zau+&d9tjBZpkh8j1)I|=H0I$9T~p@4{4z8q<{VNdzMj<<`r($!kg{pAk2tW8s8by? zH4s4%<00~>#ABa$hzlghoZk?yh2ESZ!jj}9iwtoXNjMN-(FyLWL~}O!%lPzH_ks8- zh~$EX?rhWi{}jQxp8oHMh~<;mUuL>P=yOCA|CcSL)qz=e$r~&vkj}nJk~yZnIuqAk zW3Q5Yzb3Wp?x@6_z2t(}xQhD$r=B|JS1-3Kd95pWztwB?k{oe{GY`J0%f2)O(N}*b z{?m!GIv$g&E$9mDo~K{z?nm?uXA?R-^SZfPK;tU+&92P)WY^}|`;S?KMK!O7?L%GvL_O&wku(P+< zL{=>q#Ek?Emq`_wUO_e1pvnfXE~~{9+C-XlG>P}Ni-5SmqFwv?T{61nPJ7MZcAA?? zJD%(8G$TeoM?_ydcdHS=CP5~bSuow?(ON<&a~C-m+>6|VrA&WAd`&VPv6n=1*nyt! zGN%y1`O3&BsOaG{{FBSCoA&$Gn_|9u0=C#%3P(-kmm5}H1 z+`PmOCwO%IJpM%7u$y_9*x&Q_gTD1rxw11FiWySj&Qa$8kBPH?)Ehbj@2KP8NpI}9 z2juX`b9=})tf?)TlzXu; z7I$Xj%=2E?Qf*AS!5zhLdVsm7^(qVZHnDJW4)!*(u+BQfq<@HePLK4CoWbGbz&SkZ zPn^U3{$$)6;vw#ovvBYJEL^4i>MY!QBo?kViY-{U_xLPaX-pOi_bRe*e-jJ$tM9@p zYsWj-Cr9qYIXFD@oB`fHam44s-N}$l+)@@E-k*i5v|pWthmXX<)kd)e3lATkg)5C|<3(a-37CqWbN2UA zxEH8pXUsn54#|-_*gxzzhi+%=3=R*6&bWKnclzVb5t(?06SrrxuwBukyrpKJSNNyO z5Gsg3f~y`!UHcYNRsyOWMH!1%zylaA}`4+s6>5yswRGO0-3-XoE>$`C4& zx4((J{p#dZSr5D8!NDOua0dIN=L{wX69;!OtTj9&!$G&#?~N;xxBpn&TVV(l$vfCY z-a&Qps;t97pLB`4?+`L1&Y-`4=wOWZok3?f=?sV6F&-YP?=NZ#Ql@(!z$ zS7n`e_^5L*95@5g>p6q*xa%B_kB*$)csw}5M@LNgdlkuh@L1%nFocTaJ={dz!|LQ!Sv!;Q zaDa!dGaMcrIfKdM$T{rbo-;W(JaqfS>m3fOZVrc!MBXYxs7T(UP2@eQPF|I@cZ9o# z-63}R*u&1Cd)RYu_u$YW!=5`h?0db*(Xb+Uj~mOY-6Z`xznfx1 zhgDJ7O5TjdKu#mfh`=ljwnX!>@e2K_$GobWS5@nw9SD9yJtAb=kSlqD+wbatS_*2t zPOq=+OPoNE8%h>dR-+iQuZmAS#bzo(McAZYY zaD^sC?y*&5Rh|m!zUwMZDgb3_WiA%tkh;H|6=W$}7B>Ir9{yq!+KTfb)SxT6v9_vf zVGlJ4Y3Q%o%4B;PjeRO-Bx^EPlG$3&@36S`_(DBF=O9{)xP8r7)uc> zslSXrL#o~Z5~CH+a>tQJL#RgTtzcEjx~cMUWrrXLEKN^sB4D0?=p0x8RMu~Z4Cz$O zUu(oh?7Q#&F(XX%MQf>B{q>DSmip>q_UgOuM$AD7oqZ{Jr96_zbxGS&B&U@uD|H_qEx^%Bq!m?9=gBe^LY0*v@|0`T}s{EXU zf~t#v;&dKjU!PinxC9Isi`!LYeKI9_n>c0ihZ|*LTAq81C5eq0tOCXPvxmV~9mpAj zj&ZTvVk~KylHn93r&o+j-G&vEChr?TLn0`?)6~WX%+GTfUxwGs&y6u0DQQRL0VU&D z9#Jw>gg)M%2A(mJy3@Gh%Rm*T^sx*#%!=o1Fc~=HL&AyaZ?NpjO?X05bHkZ5r3w1GmwzdEz zH~RGbvue0iUQ=;J@nt$|3R{%(=00yNQ->yZ>0LXy*_$Jw^fbAl#;BT9Di-t#K;NxXH{@j{u6ymO>{aI1<&UcI6w}NdqwYX@?RWKxv76KXt zP6pCC;u;M?$W7 zYt_XZ3Sj}a(64U^7EI|;r7uHx(BBZ=5e7jCG$3FJVpJe?Wh$$aaiR0 zPejpay8)CwR_`(OwYty?Q5WjHbakPUN5LIrdcCizE>zlDtuB<(qE;8G)rFp_x=`<- z)P<_OpYN$f)Vr@1(Mko|?sZQT`TZ8OhSF@s53ZqAZN$$REB>N- zP}Rs+E-SdRf>ZCMD>#(~wyAZS9>|Z;DU)f;*Kf&X(Q0^`$I)O~U018Yp4Lf#s>VV3 z5)Ogn42#0Uv`8!J(CKswvK9v;En~;Og5rk}6)ER8id2?<1{YJzj2^*`ezuI4TG8e= z%BIc42abyU>LHg4b<`Zi>u}U~m8;-y zpZ)W=TW2AeClvwRmMV+-Gwr*noOzJIa5d9l+ULhm85qMOFs1X%SsFeC0_>p zUdflk{jxIMgI-w=dc&i#`u016vQjn?S85z|ORG#;EBH3-9uCUB9UL6!<~o0TY>paA z#ZO16HWU7bDr5L^cr@_(M~9ws(CJT{0onJQ!!9{+jt=nn;IPvlcMd0a;LEe%B;Gl4 zoOyPRvY!lZ_L?Jm166t7%s7_>_Mr(EN|nm&QhEs&aPmCzLwcduGEMv(@lbbbM-}vl zPv>xVR%y-LGES{I;9;QlZx31HLC1*F$?n;Cl5%`J8jTw8zb5=pH+%R6HLXm0s=D;e zFkae~>W^H6xpV|1(eyWK^jGuit5?|fM~#n#3ln?#B8~l6L*ZvdRasntUdJcCua>dd z%+!*nbD~b@TeBr*IIWY*@}uDMgf9xVCq-j;@Il$;D7kx>q){VPeM^oQ?9W6G{@n0-h$QFqovj4yUUGv*>1tLap=DN;!KTRh=#^AX`C|KZjpe#-Tu z#toHp4E&;)HZ+_QKZKhq8a##BdCGhb8v&J3qJFA*iOz{T!y?o?mOP`e|92QO^=Sxv z^1H>w@5?r7m(K$%Xw1M=zUSc&pCjyFa#OoHO8!B;aHbEC+|I8CiyYK_;hY_FH1Ji1 zVgCnl;SmApD$kYL)e|8)l(8puw-mrwBk%QjwVEH2X+H?;F zjgFCvCE3-V;Q6K9zpGEjs=br6k7wsMgZLF`Y$f84<;71j*4A)_s_I~cbNK!+`2PZKNZWrzevjiZyR}2 z#nR`OAJXFIoU*WT(TlUcrbRF4l;JQEWMiqHtr@!ru?PWh&>l~~>ZW4bAO3FD0{14D zAO-Jmv8n9kKQGg=mvFl(Y*U6pX%PJko{D$&Hf-E#kw3`BoLaa9M5t$sslDEuA98ap z+@sgt&rc1ewf34me2`7wC!rSY9i!*A|LeNUJtkgqZ#ln?0<{u#$1+1Pggr*Eef>#) z1Pb6F0FVwHD_X3sKP3Wv1B(!4-UYh8IR7V383Jtgm@-BL+D$8iW&S^Cj<1OWxFC_} zQb32&+B`DBkq`BEz<4e5)BqwV;B5EzAdH8!H)fjLy7n+*-sy;t+Soy7?7$B;jP!4gGiJ zPN2P&i76_!FbEgYyh zp~1b@>PyB%feX*E2%&S@0u54{JFOj)v)%rSAoyCzuZ;$c(gC6X20_7Gg_k_IdP{DI zf0aC;W7sNb>(>xKyUS9cxO~YCGanI@PeS{7)tLE?SeT?tT?e;HHyDbsGNpmhk z-Ae%UAo-UMZ#Q=sW=V#^Cu}$Wb?^Iw=9a_ho8hcfwVDzS;!JloTyQ-OWDNv-%!HgH zIRktf%Hl;$qD zqJo14yMX2!H(eK)LDwb`(-8t=NpCHEmzaRQ@YdSK-n%J-qtC zw08`jcW2$bW+4GFTNaECH38hZ@~Mn(C*>5j0E&X<6TP2%$Q(5D$Af-hZ~hgcKjb@Z zb;7E?vF(SP%YE-B9&Yij&NJMXd`K2`02uq~Uhv1t^R)1#*zMfqshC_wW8JWvw(5*8 z{-V}gW{g#YMDG%v=uqIvgt|GOcg0epqldZ{r>>aSy`YSpk|l|W(bW{&)qJBa2I4_bE-Gd*PeF(cmZbmpn~#_B0rcxn#H4$YUTi}~d@tT)Pg z@7Z}Xy&#;OuN=N66UyXjCRIN4PNft}RhyOpSG|4J+t>5mzV4vaW&BUuzNd>X>D_+4 zImRytL$wb!(X8jhs*dD%i9Qe+`38Bq<5u=!Zc2t$4|&(nCIojuAA(2(J}DRM>qWY{ z8Xv}FsojR>vvv+)=GzzpJ!b)I?nRy%-W#R-f*6rq9*c zDLU4_8ln8%?+#h=YyIS>y(UXoa{B{9UjH2;kSaK~`$eM=e9q$eI zR7D+Q&%n_SLaeCtXY+P--XGN_Rv~{cwHhD-{iwrCtS!-xd&8U`Zm9%5Nz^3Q6dT0F zLUc9{eB}d#cx#IcbrD59^npwwxuL+mW%!}`CSikNh=w2_ihK_-9)hA_(Ilgs=%QWm+kC zb8$n@%ZszWqQs`95|eZdA^%2}s$noHnKJM+vA&q0UD_D9+W@I0IA&NVM}_MvFm(G1 z_R!_ue)umH?PUD|Ff=-i0w3TFg07*@Mz^%Qm|18i{uCxPe>yXQU)A6*^jT1Qv2%4En4y`CU=QKL<7Z6fH8!qQ~Zn|59F9cVy?I%Iy5HI9~ux zGuZSZaVoK(9;mXyOG@y0?7j;w-LJr9hK{=AoW8$MEgM&1>SGekiH5UitXzX7F0XEb*u%O-f9feo&DE;s z?POZgkS1l$mR$27QC_tS8CLy3Z5y%nL0!|AJNN2=!@jQ>uO^<^axeAq^eP`{_X<*z zb3pdz-{Y$PMwZ8?OvZir6NGu=KT@B-h3eR2@(L1K@@D!cWL0wf5?q-52_=3=PgNiQ z!d%#PFP1VS^VZK}*qnd;sI#R(ch=`M>~%KBQzBzR7vwW5_PE>Xw>p19>S=y_`u^fi ziR;1-id;A39EUTQL$wL~N%?kAnV~Jc5RMam{G(-aLUU6%qcUFHHe66epMI88zL+7m z2@h8qd9ViJg~Oe(S@# z7lzA#jjk-1Ve`J7(U<(k@5%d%ihW3fhinrPv4CSX-G4G}lPx#M1#z3=z({et`bI&X z5=XH~fG6`kAKAo|PCRWE6@`yaC8E^E6D1!^s^~zuyMNKmv83YS`HU<5r1vPh#X)!n zui7!mo}EMOI3o3j$S3+n)!o@^*{Lh8w(TG)cl9h>9xm$9!$QWKq*rS`F609`+J1j= z^%I@W-v86m`oHo>2seGsu1?GxU>{~dqWEu#;O}qBHTPyFjF;zAaoN4XH77n1p}kzH z`tU9u`<0!XZ0-5smu>*P^{?~z@P=c>i~Qp7829xVzU@Q%Ob46?hbAVVyXJ9>W^_73 z@iNiiUlT26)SbZ}zK6!}s#fZV@W2M2S?KhyCurAQy1tHjFL*Sap@2&T=%F{g#Q0RB zl*)+cO;4K;0e0`x8v8Fv2^9MmEGzw zCs*8z3n$iY+ft4`I)06I-v9IT=XWP(?{`u>IVXNhKcvpgDEmKX7aZsT=B*v!HTKes zG`JaDQF%27{g2&IquV=x+f=Iy`D5sK4{HAr$dVRRg0p{{VTneKHiRnYlNqK*N|{e5kV@lUBIgMkTSlB1*$3Juk(alhJv!GLBq5Wg6hKFuTJmd zUd}uVW)E8bC3GRq3T3%CD^2tR^Q;UjfmoWc&A9a84~ao?8*}noD#K%CxFt#4mu{z% z1@aRr=!&jj9IsP$QRDwn84oB?pW4BAB>kmcSzubB`6P@4lM4J&hK*(s0mQ5ld@>1< zq#oEkVvw=2oe<6N4MA$siIr6u5oYa2p)_V8MY{#_2+N{)F2^KX5W;q0Mw6wo*J{}_ zY=YTrJ(0RlI+@l)WOZoA`Dtx-;|MyNXb*Xmo1=8Pbg@M4VwF^~mtt53{L4j-}BvW~aUAXj?bpQ+}=9qaW%!Bu>;Hy%U zvWkg2Q+_DQ>%Qy`_YX_pr^{}qb6B-4IFZBUI~)WcD%*C#Cg3+~Q{gogs7kcXV|+`9 zmv}kCqn_L5My8QCea$JE;}Vpom>w2Q6n+J_zw<^_E~%wtB~r5Fg$R#^a#7jl*VdWW zeMk{n9O=`jsDQXC_n7T&C10sDfGy=N_kD(0ud2*6Y$KGp^E22~TMKKf-DQrczk(L3 z)NBmBWTz>+A#f3vN-E+9eF6-iH(UhV+&wn*%vAp8tRSVhP)OIt*-i5KlwIFRSW`pq zUjTZ)`=*kIuk;AW5C0{>`$8`i^*B%{lhn{%0`R+7h$TSj01N`) z#~7wkV&)Q1N%p98A^ZUNxYEI>%D{W79f+Ns1FQ~;a8Rj?+-x6wrKc>>0xRnbjX!!^ z<>e__Ph6thX&orQUgPwYVEPZxDPv*I$I8`<5e=-6Lw7|}<-u|M!^$xJpGMom*#!VO zWex~TT37^FW9VN5qE?Q>z|tY!f3@QI6~NT0qzzPW#Hm&PGhk_|ac+0o?q4cPKux=z zl1@E2?EB#{?~S}rf^sJ=YS+Qss0`;`ojaYWz_o-`V#IP#_ya@Thc(h&Bi-8}-KX&p z_n-)OXRu$R*y+C-#eTLZcK%Uu=JmcVik(rsx&w+`Fo1ib*xS7}z6^?8@wI2Ftx@ch z7Bz}pqu7tGKz{d4<<2Pf1H6v!0CSfOE2*NlJYnc1NVD5L6 z5g}i;x_X}9OhKE?zF9oGUwRnihyShO*%|w21-i{adz;t*vyCa|mBC#;pL2%XNC<$D z0QZC<0q4G~1SVU7k(FUM@gTl~UCq65;{xbc0c*yGkWqbJMSQO?TY@t7oHHW$49giT zO|6;jamOQAqzSikAQlmU;Ax^HZUm_^VpZq_Xa}>U>Waw*Za;44 zVoJhHIm)I!2Y-Ld7Kzf@#1yuMG$R)jLknq2Rrx#-EhnG zqp|6lQPjw`VTP3?z_4y0_+={)JX?E099JxZkUJ`IB9ct4Ahbr;65PE8-yvw!SYSU( z%^49~<%$OZ{hP87vOpXaGb?kNE#`9YD-bbH2Mw`%bIoAaX}RFl8;u$hOoifvB->xC0iYVUX$BU%lgp zLBNv+pi7k95E-@>(r&Xg!6IHc1w57KMxV0i))6G&l7a!W69pa|2Wg4!G+wgMQ*VLA zB*!mU&YX}t&|A5dS)rU02!6ZFW}9%)a6W3uXz(v$#vYW&z1W62pVFG6u z#tI>cAkb-2=8;>TW>*oh_L}jZb_1tOrjeqmwoq9Ae|Gnp5FdE&;SCHnOI_abf-6XE zT<|iD3(n>NcEbmiw+xP+vAo5s(k-k8evEuy6)!a#Xx_hH@!qyYzmg(fvR}!TxJAd( zGGE5f0tQ}eYEf9ewn?c%|Jo+y!KHb5Naf7ye_d%_|DMvkf&tuHnztR+@@1rX6|pW; zZ7t19X;Dk_YH8jRl;&04RPHRz+YX+*gW#@g1W6VB?FDz+*7*SYXDzr32O9);gIaL+ zV1m0#F3ttNrR0SR@A5on3fipp%?j@ZrF(yV_%A|ux1GT5l79d#a#%t45Yt(;Ji3%F zP_m_T-0Ar}q^Cl`1rlP<|#NqWB|eNd791z0)}nte1Pq<7BGav4FZN?Ens*M0mJ(bmscQUP?6V&cXi3ZP>8bW)j0_K zUbe&`&xEF+&3oUh#9>%^7UYM2Ux~x}50_6_*6IS3EYnr+BPj z0QVM;ZHHcb8Sz*}^eDc4C?Kdbg30xoIN1eExjJhl1>%6c8$=Hk z3cXSXg{gzWJRR{^)lKEj;<4>vzdOjt%0`h?G2C88wr!mcu!p`l8QCmiA!Sn)J~xe^ zW2e>;;J;i1cnDv~nZG<4N0NA#Z%^gbPbuj^Xkh--@r}PJ!PsWbdun0diZWD1tAafx2!9D%TjVw!v$B0ELYt}5p0o5JcZi7t7_~L%dsY07}=G- zL|Ab;0#+}+jpL9^xwdDqdB4m)CNX|#x6z5`frL$M*4S5Vz$q8bs6;+Q{s6zSaTMK_ zj&h>=bNTiZ9V2ha@SM84zm6KNPhDfiV%)STk97;?bF7?Ffitb!TjNy=>@_~_6^BU4 zMh8b03L0*X{@m4Jymd{GUj;W$`dk*{dwukjlF%v8vIoI6J@UT$#YK=y+4Kjr4Ty6)W6tufiU$ID2O< z!zOO9AF0e2d`?iv1LUjd?4BB+M7zLldy2*89Q+q29G?^8&auCMT(B%K5|~X1;uADt zf?&y+L=K|N^&=HoXvPmK!PpN zysauRp!Gmha6BA_+xkH_ums3@9g5|KmOR+TM5ye&2CV=Y-Z>_ zc$G)TRznUtfZ)#UHo3*~z*n#nxs9Qw3mirQ;#dRNa}hE4l`?d4Lj<5M7~mEziNc%$ z4$FmN-(Mo1FVGD@I~pePh^CkVXRt2ZL=!@M1U~EmBXVZ|dYMtF_KA0jmof{%#{JP4 ztL~72S=;TnW(y1&A`j}o5-oHmJ;9ax0JI?FnlMi`P0Nsn5#kX~_kl%o)BI3Z?$bF9 z6|e>m;%=wYNiJQI&&dL8Hw0!L&7E~@96_+B&Ft8YnK_P`nHghdhL|y?m>J@jIc8>t zH8V3a#f-aV#@pOI>E6AAzi(EmnbMA08fi3LUG=N4a|(W7<>Oy1x=ln=DMztmmqh() zQPydHv?zDc*Uf8sSwgYs77?z;b7}V#6&rL9=;#%=K~%`t7YU|CoDKXUNA?w0ws`Jw zb6AtQofR2WW<7cMDwN2M`j)xmgAv_(#K8wHRxHfGhp&C^`A}~cjBZC2NZ2i4NRK6l zXo{KrM9JFShmx)WNyj@3i2_$Z+Zosc^eAKMukA#}GA7S+;FJB8Wjg2aWC-Y``3Rt6 zeBA7p7YcND?s+r}n_!1>``%V0!hM_>qpbvET$c`%eSH2iKF*iy3g4Kg#pf9%6|H!b z{QLp5v5Hx7u#R`2*E=SzQ7%oTcg4qOZB-Z6Iwc)2(-=d&u9~D!$y;I30!oW=x7#x*;3#md01+zl0H6G%)hLt z(_PY&wvk519f}qSr4-U6UmZho%&xY^PoeAJ-3XO+w05ze|9Kuy%qZJJOcK}z*8#Uo z@d>7udzaTOn5ROD;N|`mcqCz=ns(!EL)X$9PR$bm|G*wEcueVPqrq5E`Q-^QL`<&US<&_EPiSaVpqyxhFv_k);Q`xR>r#C3i4n|W4e)tRN-Pf zLW2CfdL(CX879VX?OV1FeO8o5zo|d!hf_E=t52E@K)9QXYFT#5w!ydJ!31tq1(iB2DwW5vdFvYlrEI|z^8+zdyeFFU zlM8i2p{fBJkiQynt}Y~)h{4|h0SPu+q15)T_^xGSE8;-7usKO68n+h@&w%ouQAB+= z3ThdHYZ)>rF%PIT0@zrnN2*jdDwl{Myh}mGcgfE@GIZ~wzw-1b?q0S?GS~=ww4G0Sd3Muu>*{mH=z{Dd6tW0?d^XG` z0_i~*?7xDQdfg8U@s8Vw(JEWi?MvIV?}+K$4u#wxO85{C4NQ0HYRH z_@e7g-dQXkWAzK?Y5)=HlFr2G2Qu#faq;&&FZR43hT02yImQufUV^}q8TC$xq~ArR zFq57YuYAM5KXwWh+rK9PsM=G$`->+44QbyuU)mCYTLrT9%kkS=2|&(de@0nw_GLj` zPrhDFcOe0&oA3rhy{hq$^deK=+`pNV%HWOqmJMKdnc6EiU!`vZI>wo=i-w&uaNBxN zL7WUvGrTl8zLvAVtS|@_{>(mI&QZrSE{TwBDj)!P{ z?@Q9r($`~n{esbe9T8mTQ~i0TW9Bp8vl~q6m2=raGT;D&oS=0t&pP$KoUC*U)-L1wbfh{tF8hK-ft`Ra4nkvLS8QN?rfl0h3~j@K_0( z@{>f1u~t9tz&N;P?vt)2GQ$N;?Q4Xh<&i{7Na)2!83q(AZO8Zab%BrM0XW~Qgt6ZF zRQ2p(VB%V^A;o|svKgp7-SJ|#!7?(OAh}vq+wHjWk1b^ksm~RE zDcvU@p$eUhk)UWZRjU16S`ikQm$d#c2)|7}v+c2QbWcP)oBtNCpTTiPC9Tl6TZog` zP)Uj6%581WxVgoiGT4E9U zQ)bmEJO!n&Pro2kN|0}o-)uOM@oiGxrplf~#;5Ge%*;P=ynLjn4scrPhLb;zr`)BZ z9WEfwv8tH%V?`SUOW&k_VJ6;udUC8qrMvJekkSkOSkgK(qc{7_WmJ7dmbQ{y1UPxc z*HHqBv)zMeC|dk6n9UBF=*4$1i|Mx1wh-OONH%A5Kax9Ry}f0028lUlf8n>ce3P6Y zB|JSB+tjcHX;ryZ9GWe?5}9DA=Dgyu;@(e_w({^dn{OidZ)Pz=`(~@f<%tw_Q-6$zVBdImDzXGQYzLhhoBovmIRFl>{m-+Z(?7sfITA%Pwu{QzWWE=h11 zuy+PMJ@rq_h9Kd;U&y<5m^8V2_kZELOfNkGZ5=1rtR zwTdQ#LF)ovtr|9^ww-T)`e_T+hw>qxR$j1VjZx4^zgLY`j|K&5B-8=;_?05Pv6gzY z1$&d?4uC|wU%RlGO6?4!g(4gfY@=lfgA4$$q|$75@OT2h!Oc%oCK=LsN)a<90tYC% zR3r#OL?ZD!pO%q2WEB9eJHT{n`GE#jSw@}jLqu~-`f@EF678Eym;BCz!25@;b;ik~ zq^V{@mWnxz3h1lDOUgTO3O|b_AEVCT_2%mluPArvN~donlhLV#;KNHT+eJ17_!B4h^RcN_(Ku>9<(6b7E3`478IdV7jW#NeyqeYOK z%#e_I*2q@~j&x$wHDJHooVcphp>t}&z>we~QMS|pxzy?-Sl%c?8X1Prz*%-Z^2TB1 zozO62Gv4iIpUKNQIXVlG~J2f11hDCM5dB07_buC9E z97RdV4pGjS36EB7$=r#!&V z@(@Wb<^`gsa_g8XUSX{vRfPrYHbMVblJX4I{^=o1@hDwFBNXa2CG8#m_Vc+rfHX|r zD>sb39Fp2?G48Ms9&50f6MjCoAn_YShr;7+7!WXHw2S#w=x|pJuS{F%v;N?d8j}@I zhA=8Tax5uvZVd9}Yhxl@5!7Vw@}eSvK)U-J-{%cIe(P@sM)Le+`I+PDdbTu0jirD@ z8&Dz5@wdFwY-cS{;pE)HQBhQ5nBlZ8{t0;ANsiaF;@!xN`Ys(_l^lOw6Lkx@aU<&t zt}YFpkss*PP$9fTE{hWg`3h2P+ttQFEonLuMQcW-A}m;u7?O_SD7*6$nuVzz2279O z;6QTih<8i$C=qTg7=7MX`dsil19Ht(Jhm0hR3?;`m(FAFQj~uCMqy9^Objq!!ZAfe zfpYgXPW>ObRJvd(w4_XjZB|sWIaJit*dT?hp-m4CiE{Rpn!3`Xa7k48i-!K1NJ&&u z)JR?FAa64jTe=TjZS}$Sn6jp!eDKmjTRmD*P?Vwk-?K85KSw`%nyA_y-&eAh@yAvS z6>3_wc0(qv)v%Vq-yA=sG@LM#PBkhH$~XNUXV0Rwx=H5^G<4?}dn<{R%8J6rb-~n% z|F(GbG#<`=>xtUoYROZ+DOJ}mY1L0-hcrH*c?(0W!Mg{A1@wDzYJ!fJPZ=4Ehgl?~ zlTBkEk(r5V7$z4nxZGjHtFRs<6Y-U@H9WN$KInrY8(%d z?x)gog=%U{w^6eH^8>ax$GQS&vEuynXS8;kLgUwI^-5v=NX09728d!^C;vH9Du$6- zGP9o){KP9-$U?Do=qu3z0yudKp4U2JqJOxf$ zpvEoin(D@x?M~J?$(M>kGwj9GOlSrO8prr}(VA5%OfBc6FK%twJCm5$Xtq0iivbuA zJOo`STIaqS!EnBGsVXRf1m*{`EIfTPSC{4QO>yPx`AyXmJkgo#)5Kf`jLVp6Tzz5P zlfBV(n^O0;zL%F#dJ~*ksV}0dJH8T5id5(ZawQ|uDLXWDp4JhQUSsgJ#pixBF^V<= z19rnYF`#=>eZO1WJ_B@xEy!WTky;v8n!_;Eye??R%^gv5IkN%c-(qh&URFZ@jGFHe z<1>}mwSI~YB(+Us9yAHFD^cuaE%Q;)`H564JzKUz{uX`xY-x2h)eB-KZy&3$YlQN* z&awHIIdsm=D2U)Z0}l1Bkrw-EfvlhZE}H<0Et_8Yl8C>5p2Lb$L+Gzya+9&Hh{3i~ zeb}Ouc$Cr#{opTie6Fo1rIC9OQ8GHf(>6d*Tbm&Foo2adX`+JWrX5u@cJei>oI|g^ zlyI7e44zaJMiFt&N%m*LXKfKI*D$KL=tgBAjjO^fv0!F=5q4O5E0Ir-6rBi{wq4$v zX!~DrD%U&)(L;ReHrTEz*FVyX7@CF(Cdy-IwmkhPO!t>i=qsU?n646NU7?DU*g#^+ z9QxSex@N?Auj`J$fJ+~tSUmLfT*BYIpZci{sTTOH(pP|`6gXE@c2;#RORPK&2WB}F zKV%FJK4a@a4kkNBH=?opqWbzEamlMaE-MJc;kyzj|6B2^d^^L%qp|!U8j&_aa8FMI zTa6Rak~{uWQ$9?W0`CuE);@>QZG~QFr9NQpQ}Cd1tYa{QFg$>|k3H%AJe6Yj#YpS9 z{ljYRuNzfM^X<=n-@j))3_Xs;rMbUJIDp&cly@P~6URltgX+1zjOf54>URV27E8wW z&YKpSs|zGXG_GI%XyB{h2>*{j{C>xQYifDFn^y~@H9HH%oK(gqL67GIBOV&Fy00yh z3zuRO`{+4J*H2JR$hgzc3MIfDd(5E~9$*~raFN;$qr_twc3_QiTubW?qoIdM!uIvq z=+R)wQwRe0w+>>=`-r)-Ct#xd01x9uJXyZ8+!tA-t4B`ChJ(qK*!h)G(UpW5TMSt8 z=xX5~S32^XxjhmRUDF*(JDeZ;(z1eTsa}xL4wpWobN9u~rucrl)ubC6R1xeGEu``5 zN;#X2q*%ywLcX6Fc7sCaPLZ>sgnuvz`(~S5Kh2lGei55#B#MPN($Vhkj-l91R9a3P zbW1oiiah{vqLwt9@C^F+WZY-69`21EA!6=P>p8{y#lgRXkM^vV_R?(iy$w`*CQy^j z_PJOB!-{0N&A_8RHpB_FXPfcf9DsP zKKyr;)eK=dXx~MIzQx|_@a;6;On1rG_&O%k5)*Q!`1mxua(r;4s5xGzO(w{tn6gF} z2el>I3KKs#V{G_jKjow)4WJ6JeN+n3(lnTd@r;?+v~hH4TXjIuN_M;kU!FpTSWsk( z-fOA6IV#zy@IC6L#B**2nn}px=o3StPJI@I_=Sq?6}!rIKT!O`spd9UrEcgKRm2g~ z%mb?`dQk1u(QkA9cWMMsLqvVV{ooQo9oly>7!xK>^G{qbiiO)EssY|UiAc35qkqbi zx7>wa#jLv@`pvfYEpH&&cM5iPf(zE5PVr5*;ftn^f@>lJNd*Yty1z^ zvXja*d$#+(&Sb(3~t4YFU(xzadJHcV~aeqd7JzaX8Vqo?!h2d0y>AmP?^9{%z3_oxCc*M!6)iX!r)tbX+t8$GWAbv4#G_YjcxXIMTi>h_aW3y7??R=!#2MGeJK8HN z8L{bg0#`}NB)7s2$Gk3%x?!}(1Na)DRN2KbnP65M4-K>+zUDcmeRko)E ze7&#BP5J(NE~Z1upu%tOnowyJERmJ?x@ot~AzIsQi@PBXqVfza^*-ib0J+Y6K|XsU zLA@iw@$-!i3%!r}c1tOd)It_Qj4O+>wfngDy9Z()#;Zz~AAuvkfGH}unj5(WeM!`h zZXM>B$Wqh>C(e3X*7m0RTjPSsVBp8RNDeCNp}i(dN9& z15u&+LZ&uT187=27TbQmarf$U)<5?E+F2f~LL)_OHUx)8drSX9qZYTp z;aG5JR0U2yw75m<35#yD{R@pYylyaGJWb|pkMAn$PX2{P#adRLjgT2a<#i|FL&g3x z79%l!aeUoA9xn;tc^^7Gi0f~f+OfI#g7h>}K9>NAZI?=z-_zy&POnWYojpH8icXXMmT<`_O=)iof%e<&qEb(tbhPgsyQ*;S^g=15%tL9Nx-iY@k>e?imT<4& zNGYqjFxtX&_VY21qhA`TqlGa;?im+(^&xICE;fUu}Wns(HBbwlv zeh+LM56+=%$Ww^2wp=whKZ)YcBCFgR59DEHuLgty%xG4(2!6uJv;DbS&;vx;224v{wper8_L37{ag3aGspJ|?*j z#^)-nxUSEUd^7g1E2}PVg-XTl;os+iS;hvpF#I&zXx$^SKISzERlx1>{?`7s{L3bm zSovL-|8e=8zjCNJ?gWpuz9q=$r^YDhL@iHx!VC$5)#{cqb6?kWDMo_>TM~l~Fi`v3 z5VZX2%2>&oe?Pwdrl>B4M4mg_XXiaas>syxnF%}?av8V*sU$a(-7>FP);Wi)q^1Y# z9ANQ!!Zli{E)!#h#k(8#3rKj@80`&y>@iBt<-&J@sh&g8zBt9gaYdzvS3#8FNymI* zgur9IpHOe;$Jr)Y0Q{Dl3 zrN~dx%+{o?G_;_?c_@u$!_}{#2vl1@pggHU?_?1aH;B*rt zQFLK~fJFCO(}crPglwoJY1R(jU=#MUx~~1ODY?Nur*oS|q1d#<8gzDO@u=r7su6Ws zaT=#^X_}JL5NRF+1WoBrK&vIY!85^lP{6hfwV1_0+$f8#l;XZB8VM5qS=gf>YZ#8+ z&Hf?E1;SLOlN1r1xx_Z->{(-br+f2XcS`(gUW_?Jm~bcGPio$E(6i?edrZT%Vq!qU zad$>zIxL5(FMbm=2iN-tCO>^YsHTxuKf!e8kzmvd(vXKCizGiNPoKE%d_apjeATJ+ z#1+(ooL8Zhal3VcRgjMTV*GC@h5Tm;Jl()3VCNx&OQ^4Y zMhr45q}c6CezxTFwW4ABl6Jfs zh6Od8oIMCo)pR*#bkDRZ^=MQD;HKWU%FTrIkL$G7QDa_8$)};z)pYEahd1O+R$Q$2 zo?*NQdAxnR34bs@=UOl&Li)zeD#VRmeT_%{X3Y~hbox|GlK5PL8Cye)B(~3tXbP{+W8N*msM z-2>B$cE9RNG~y$gh$?g0dn@#PWX8c444r`!gXO8CnLRgt$#tfU-$yBrznH5zIYHq1 zP1JUylvO1C__05$-2G0A>?ta_w#o>Vl_WrVlX+OfLD%@W&k#H4IT$ zg6hCv(1RwVo@$2BmnqYfoWyCe(}Z6R{TguOvEYF!4}q6&K1n<}eASfv2I>Kg&MdG_zj;V@HcDuWQ;ziKWRlNch z{T?=DIV9g4Fz@&}MQ_?K8WBer61Go>UZX1R*cIJB1*|Njz!51HeU=^l3UP&brE4QN zxbEl9R^$eCoBnkQ#+3vb&dT?^IA@PM4=r8^DA3O_EvzJ*s|NLl5STgW>71ZVKd(}c zmUKS#yVvZUgwwF5vT~787UcgCT&|G@d?xuBS+4Y{=+;%|r?=71*paQS$m*1*DE>j* z4SsC5yUhb{z8nf#{YVBVX5Ht^7%Gh7{A>rz zf)n$h+JCa?&C~gULL)TLL@?Ti)wY*8Fi2|3mkSMf9y5vShb)ShGT(7;C!F9{lG|;tr_Fb~ z1NIn5ZZFS+4VjVG;rK36po-RkW`lP)BP(r6CKH`=td0%Q*von>hg)iRF5RvZ>p)ZR zzfr9pSVIC|iEp?vw10HMnvn>EvZBckcTAFK>O1!S$r&JNGU&()N1(WUG~1f$-WTVI z_IYJ>w9I%#hZ~L+J_Ie8lZe3|R-5@1a6n@QIM3HQ3hr$Gzu+rO2=OVYZ0_9_sqNwl z&*3dcw=x$a_(Y1IGW+}A2Y5Fwl!m})r`;*FGw1&|62;rpU?|*|?L+}C243vAxA#4e z-Cg!CxmnF$LK0$6!3|GSgZr>Ozv(+T#hSnTu5i9+{9sszlYY%lk9~IEb0BtcJE!1Tdb;Q(|cI`wNC_oR4&UkkO{kbTi8yIU|aM z=9IL`wH{>Ds_Jl9jzx)AdW#+6)}_Jd}<=xmu3V?Qm&meTV2krEgvSZ#}2Vy@VmY=L-P3M zXTCwuJ=j6%Y(T&MBh5Bbjq_3FjEfAf{Y>jE+=#s#M~rZ}iS zHqLJEv!>p?Ko8M!+s4!wz0%5NL2fEe*K{~p7&YHR==voFM~$oNO9d~oakL4rcxQhX zrMuP>{{9u9)|^#NI5WlNDStbVj5zIpsY*kJ;_T>f)d;19$f%kp{O--n z0EJkEIYzM(*3~2Nus5XmD-$%t?Q70i!u^;) z%(MEYv;ok=zK@WJxvJN%El4CZ{j@xk>A^83dsS6AGwAg62_DjXjIXXxab+r4^-S`u zrqOEES|s>9=1J*_#39zed(Ef+&8k}Q+2a`rv?W*dSI%x*;hl}{V4}=@s;4Jju?IEs z6OH++kts*PJpONPWRP{Ewd;_6(Q{E_mwM?}FL4oERQmT7x76y{6fA-CDdnD`LbIG) z?#_kb;w3N#M8eTamj+XP(8o*sUYF7x3YeEzG76?@&TF4gWoJ=}ODeOe=}n&V+)pE8 zMnT|jf-f9v?b%a|5XW>Rk6^T_=bNqt4Drf5w2aIXty9pS!Q==aOp@{Hbhw5AYp zUlth5d(mWNwCpKHyYUec(0^D7C&~ZP+k81mZyH;(4&k_6w*MhH_+Hu)QGDvay&d~q zW4vO8>}$bu38{qQYYC<>tf+U>ANswq_pYJB?VUQw_Ui7Ma0?{a$Kf{1DX$r`L=D+b ziO=<6)K?Mi(&Gu?04OF#P)l|L7&{_yNYXHfNp1G*^3&{(Dn~J%Cv8aL_DClhPtx+x zYgl~l^G5gI)(?q|$xZl;^1Ld7wf|!19<{{vI2+Bk`Zyak{$1VO=*@RfjvN?0fxmKS+dUbF*>dgh@82 z13|Y^d*z$ysGu@r_kC7=7wvhpA$t`MxG3URGvo&I)L^fAJ}(}vRA3Q70F6Zj3ncg! zWxfOH*SE_%it1Px>Cf!MdjWD8gU}<|aQ<&9RN0)jnSs4;ZL9+M`@8g|MqrhVL50!M zY3e;+`64qYx=6FTBly`o8P&=%qr*t~?Yg%9-u#E%)t&AySg+_L-du|LK8l_v2x_!a z9R$X6&fY~5j0A9x5=1OW#R+yTw7js&s70ky`A)cCFU8|@+7&G1E{FP^?k-53<>gEl ziB?nI5|1mFgt@5iFsCSCei~8XQo=rXqa`5!g|43fyM>P6H))cZu!i*KKcW>rw2WMN z_`NM|(3&&Pb^xS3WMz{^8ly=*kAZ%Z@_}Ph@)W+}Sa-m`qD$Wy`VUBQEqy=e>VrMy zZF8jG>eBbT{P5U8h`27L>Vx*W<{}X|D=ovp2E%Gs##Bn2n7`!J?S4ZSW#+nl&d#GV zwXFRJ1wbq9J$ZUm^|U+CGb`C&I^1`<8vxd}T{H+Q-2r}IY=VD!&@9*l|9#idtN1v` zn^~*B(`&M;%1b8DE&C4>3>`FsD zfb_`CjBWdec6OcN`u(v})w1RpKrqE{-91LwwzEmM#(uI|qaC|)6UhO&OLH~Ay=n9% zz{?)C+*btQ3#!=Czc##7|+r49O*a_uRNbz_IQF5s^Gfzyy^< zB(z`@HsK*A+Cd)qrNavSosx`|{XVELK{$od3jHD?0hgN!Z;mAa0pk6Y+kqdIR zqAE&X8HKTsHl9@V7`6^`k&Il!0`vO-dw9ifG`EELKaoV4Ex z63p~cHu^C3IN5%TT;?w-HF|`qSpdw>nj*#jO())%f99ci$e}lJko3)CK%h>6M(p7* zJ+QL%ppEZGP?>UO+;>7VujoKJoXLJG1$E@+@xOD6lrmCdI{H>^ZZl873visTrukJOWMDL;94-_N!Ry!V%hJed4d<%GZ=xxw)gl2Tl=g z(>KCQ9ccPG;#g6>oP2PiLS=J67~})PMrr|Z?ip2xI9Fq|+hqdW&qaMSg~N!o^pUgKd05J71Kd=h#}YxyCtgN^VsaBeaISdJFSOXLpbvQN z5RrSWC)Q4BTKw|^U+9)6PmxpgZG5QCikB_8qf2>fIT!72uOq74&mLe#QdJcU1AE|J76*^4Q?by;hiv z1o23vfNyK*$jng&Xs`tV zrIDZgR%jBZzHfVwW#JP6NqNjtZ;9FNpF4MEdc?$9b#6VE=TLqG8xn{%@M0I7&>D8$6UuMSZ)eSCVAS@TCuA3eX?5TRMP{i2BXqQWz*CZ|hMCqJZH zZh@C33R_2Fv7*-)B-sS3pgCHxkW$r+IcTBgT}eXMUKNK7pEUP>mZ4Y5m)T-n+GeSq zUAd162jtA_#a%7Y6#?W<#x-a+KXn6^CfOzI`Gc8>pI*b)!Gxo#@;iXK45$-$U>)c1 z(7{k%u|(!uO;EV#a5gOweEUf$RyX*zcdABLt8oe2SGFym^Q&qw#ebN3lZHx=9rDLw zt_0 zy{f5u?Nhrgr;Ur&t)7!R@9?SI3lsQQc=(vJyHBwj=ig<%I8;p)6P2;x`Z(61zoc#c z+JGbTF3fy$3VxFj1qsuO9w3D+#ew5)1$@eUm3%DHlt))E$2VZ{5RdLps0o=7V4bgs za~MTQjCKyS8oxvTwZS()A{Mo7))bI2MrjW4N~h&30WYK zwpIH$0{v**g?qSmm1^#H`h8mNCY4h$Wd*>!VxPtD?7!(+!msL#abT;R+({uQrVkiJ zGHwq7b;k%8?ZtDF=tv8f7mzN_#-1KayWJM>J*&L(m0ro584*L4#RRCglf0!+k}Z1d zHw;kPJ`|v_m_H~lZy72+eRpfBC}R>t%L4s-&Cl!{yUiB))&W!ZsY|P$N{?Iu_B6yRr{|yJNEDsC!?-nTVF9du>u>0rzH~W)o-v9sr literal 0 HcmV?d00001 diff --git a/Solutions/Windows Server DNS/Package/createUiDefinition.json b/Solutions/Windows Server DNS/Package/createUiDefinition.json index 55476ece4d5..61f5969213f 100644 --- a/Solutions/Windows Server DNS/Package/createUiDefinition.json +++ b/Solutions/Windows Server DNS/Package/createUiDefinition.json @@ -6,7 +6,7 @@ "config": { "isWizard": false, "basics": { - "description": "\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Windows%20Server%20DNS/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe [DNS](https://docs.microsoft.com/windows-server/networking/dns/dns-top) solution for Microsoft Sentinel allows you to ingest DNS analytic and audit logs into Microsoft Sentinel. The DNS logs are collected only from Windows agents.\n\nInstalling this solution will deploy two data connectors,\n\r\n1. DNS via AMA - This data connector helps in ingesting Windows DNS logs into your Log Analytics Workspace using the new Azure Monitor Agent. Learn more about ingesting using the new Azure Monitor Agent [here](https://learn.microsoft.com/en-us/azure/sentinel/connect-dns-ama). Microsoft recommends using this Data Connector.\r\n\n2. DNS via Legacy Agent - This data connector helps in ingesting Windows DNS logs into your Log Analytics Workspace using the legacy Log Analytics agent.\n\r\n

**NOTE**: Microsoft recommends Installation of DNS via AMA. Legacy connector uses the Log Analytics agent which is about to be deprecated by **Aug 31, 2024,** and thus should only be installed where AMA is not supported.\n\n**Data Connectors:** 2, **Workbooks:** 1, **Analytic Rules:** 5, **Hunting Queries:** 9\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", + "description": "\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Windows%20Server%20DNS/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe [DNS](https://docs.microsoft.com/windows-server/networking/dns/dns-top) solution for Microsoft Sentinel allows you to ingest DNS analytic and audit logs into Microsoft Sentinel. The DNS logs are collected only from Windows agents.\n\nInstalling this solution will deploy two data connectors,\n\r\n1. DNS via AMA - This data connector helps in ingesting Windows DNS logs into your Log Analytics Workspace using the new Azure Monitor Agent. Learn more about ingesting using the new Azure Monitor Agent [here](https://learn.microsoft.com/en-us/azure/sentinel/connect-dns-ama). Microsoft recommends using this Data Connector.\r\n\n2. DNS via Legacy Agent - This data connector helps in ingesting Windows DNS logs into your Log Analytics Workspace using the legacy Log Analytics agent.\n\r\n

**NOTE**: Microsoft recommends Installation of DNS via AMA. Legacy connector uses the Log Analytics agent which is about to be deprecated by **Aug 31, 2024,** and thus should only be installed where AMA is not supported.\n\n**Data Connectors:** 2, **Workbooks:** 1, **Analytic Rules:** 5, **XDR Detections:** 5, **Hunting Queries:** 9\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", "subscription": { "resourceProviders": [ "Microsoft.OperationsManagement/solutions", @@ -51,6 +51,47 @@ } ], "steps": [ + { + "name": "contentSelection", + "label": "Content selection", + "elements": [ + { + "name": "DeployAnalyticsRule", + "type": "Microsoft.Common.CheckBox", + "label": "DeployAnalyticsRule", + "defaultValue": true, + "toolTip": "Deploy the Microsoft Sentinel analytic rules carried by this solution (ContentKind AnalyticsRule and its AnalyticsRuleTemplate registration face)." + }, + { + "name": "DeployWorkbook", + "type": "Microsoft.Common.CheckBox", + "label": "DeployWorkbook", + "defaultValue": true, + "toolTip": "Deploy the Microsoft Sentinel workbook content and its Content Hub registration carried by this solution (ContentKind Workbook and WorkbookTemplate)." + }, + { + "name": "DeployDataConnector", + "type": "Microsoft.Common.CheckBox", + "label": "DeployDataConnector", + "defaultValue": true, + "toolTip": "Deploy the data connectors carried by this solution, together with their metadata and catalog entries (ContentKind DataConnector, ResourceDataConnector and DataType)." + }, + { + "name": "DeployCustomDetection", + "type": "Microsoft.Common.CheckBox", + "label": "DeployCustomDetection", + "defaultValue": false, + "toolTip": "Deploy the XDR-native custom detection resources and their Content Hub registrations (ContentKind CustomDetection and CustomDetectionTemplate). Independent of DeployAnalyticsRule: both kinds can be selected together. Existing analytic-rule instances are not disabled or removed. CD enabled or disabled status is controlled separately from this deployment switch." + }, + { + "name": "DeployHuntingQuery", + "type": "Microsoft.Common.CheckBox", + "label": "DeployHuntingQuery", + "defaultValue": true, + "toolTip": "Deploy the Microsoft Sentinel hunting queries carried by this solution." + } + ] + }, { "name": "dataconnectors", "label": "Data Connectors", @@ -60,28 +101,14 @@ "name": "dataconnectors1-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "Installing this solution will deploy two data connectors," + "text": "This Solution installs the data connector for Windows Server DNS. You can get Windows Server DNS custom log data in your Microsoft Sentinel workspace. After installing the solution, configure and enable this data connector by following guidance in Manage solution view." } }, { "name": "dataconnectors2-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "1. DNS via AMA - This data connector helps in ingesting Windows DNS logs into your Log Analytics Workspace using the new Azure Monitor Agent. Learn more about ingesting using the new Azure Monitor Agent here (https://learn.microsoft.com/en-us/azure/sentinel/connect-dns-ama). Microsoft recommends using this Data Connector." - } - }, - { - "name": "dataconnectors3-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "2. DNS via Legacy Agent - This data connector helps in ingesting Windows DNS logs into your Log Analytics Workspace using the legacy Log Analytics agent." - } - }, - { - "name": "dataconnectors4-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "NOTE: Microsoft recommends Installation of DNS via AMA. Legacy connector uses the Log Analytics agent which is about to be deprecated by Aug 31, 2024, and thus should only be installed where AMA is not supported." + "text": "This Solution installs the data connector for Windows Server DNS. You can get Windows Server DNS custom log data in your Microsoft Sentinel workspace. After installing the solution, configure and enable this data connector by following guidance in Manage solution view." } }, { @@ -173,7 +200,7 @@ "name": "analytic1-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "Identifies clients with a high NXDomain count, which could be indicative of a DGA (cycling through possible C2 domains where most C2s are not live).\nAlerts are generated when a new IP address is seen (based on not being associated with\nNXDomain records in the prior 10-day baseline period)." + "text": "Identifies clients with a high NXDomain count, which could be indicative of a DGA (cycling through possible C2 domains where most C2s are not live).\nAlerts are generated when a new IP address is seen (based on not being associated with NXDomain records in the prior 10-day baseline period)." } } ] @@ -390,7 +417,12 @@ "outputs": { "workspace-location": "[first(map(filter(basics('getLAWorkspace').value, (filter) => and(contains(toLower(filter.id), toLower(resourceGroup().name)),equals(filter.name,basics('workspace')))), (item) => item.location))]", "location": "[location()]", - "workspace": "[basics('workspace')]" + "workspace": "[basics('workspace')]", + "DeployAnalyticsRule": "[steps('contentSelection').DeployAnalyticsRule]", + "DeployWorkbook": "[steps('contentSelection').DeployWorkbook]", + "DeployDataConnector": "[steps('contentSelection').DeployDataConnector]", + "DeployCustomDetection": "[steps('contentSelection').DeployCustomDetection]", + "DeployHuntingQuery": "[steps('contentSelection').DeployHuntingQuery]" } } } diff --git a/Solutions/Windows Server DNS/Package/mainTemplate.json b/Solutions/Windows Server DNS/Package/mainTemplate.json index 4b3daae8f30..7514c9b46cc 100644 --- a/Solutions/Windows Server DNS/Package/mainTemplate.json +++ b/Solutions/Windows Server DNS/Package/mainTemplate.json @@ -35,13 +35,48 @@ "metadata": { "description": "Name for the workbook" } + }, + "DeployAnalyticsRule": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Deploy the Microsoft Sentinel analytic rules carried by this solution (ContentKind AnalyticsRule and its AnalyticsRuleTemplate registration face)." + } + }, + "DeployWorkbook": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Deploy the Microsoft Sentinel workbook content and its Content Hub registration carried by this solution (ContentKind Workbook and WorkbookTemplate)." + } + }, + "DeployDataConnector": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Deploy the data connectors carried by this solution, together with their metadata and catalog entries (ContentKind DataConnector, ResourceDataConnector and DataType)." + } + }, + "DeployCustomDetection": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Deploy the XDR-native custom detection resources and their Content Hub registrations (ContentKind CustomDetection and CustomDetectionTemplate). Independent of DeployAnalyticsRule: both kinds can be selected together. Existing analytic-rule instances are not disabled or removed. CD enabled or disabled status is controlled separately from this deployment switch." + } + }, + "DeployHuntingQuery": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Deploy the Microsoft Sentinel hunting queries carried by this solution." + } } }, "variables": { "email": "support@microsoft.com", "_email": "[variables('email')]", "_solutionName": "Windows Server DNS", - "_solutionVersion": "3.0.1", + "_solutionVersion": "3.2.2", "solutionId": "azuresentinel.azure-sentinel-solution-dns", "_solutionId": "[variables('solutionId')]", "uiConfigId1": "DNS", @@ -161,7 +196,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Windows Server DNS data connector with template version 3.0.1", + "description": "Windows Server DNS data connector with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('dataConnectorVersion1')]", @@ -252,7 +287,8 @@ "contentProductId": "[variables('_dataConnectorcontentProductId1')]", "id": "[variables('_dataConnectorcontentProductId1')]", "version": "[variables('dataConnectorVersion1')]" - } + }, + "condition": "[parameters('DeployDataConnector')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", @@ -282,7 +318,8 @@ "tier": "Microsoft", "link": "https://support.microsoft.com" } - } + }, + "condition": "[parameters('DeployDataConnector')]" }, { "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId1'))]", @@ -327,7 +364,8 @@ ], "id": "[variables('_uiConfigId1')]" } - } + }, + "condition": "[parameters('DeployDataConnector')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -338,7 +376,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Windows Server DNS data connector with template version 3.0.1", + "description": "Windows Server DNS data connector with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('dataConnectorVersion2')]", @@ -418,7 +456,8 @@ "contentProductId": "[variables('_dataConnectorcontentProductId2')]", "id": "[variables('_dataConnectorcontentProductId2')]", "version": "[variables('dataConnectorVersion2')]" - } + }, + "condition": "[parameters('DeployDataConnector')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", @@ -448,7 +487,8 @@ "tier": "Microsoft", "link": "https://support.microsoft.com" } - } + }, + "condition": "[parameters('DeployDataConnector')]" }, { "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId2'))]", @@ -482,7 +522,8 @@ ], "id": "[variables('_uiConfigId2')]" } - } + }, + "condition": "[parameters('DeployDataConnector')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -493,7 +534,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Dns Workbook with template version 3.0.1", + "description": "Dns Workbook with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('workbookVersion1')]", @@ -574,7 +615,8 @@ "contentProductId": "[variables('_workbookcontentProductId1')]", "id": "[variables('_workbookcontentProductId1')]", "version": "[variables('workbookVersion1')]" - } + }, + "condition": "[parameters('DeployWorkbook')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -585,7 +627,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "DNS_HighNXDomainCount_detection_AnalyticalRules Analytics Rule with template version 3.0.1", + "description": "DNS_HighNXDomainCount_detection_AnalyticalRules Analytics Rule with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject1').analyticRuleVersion1]", @@ -613,10 +655,10 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "DNS", "dataTypes": [ "DnsEvents" - ], - "connectorId": "DNS" + ] } ], "tactics": [ @@ -679,7 +721,8 @@ "contentProductId": "[variables('analyticRuleObject1')._analyticRulecontentProductId1]", "id": "[variables('analyticRuleObject1')._analyticRulecontentProductId1]", "version": "[variables('analyticRuleObject1').analyticRuleVersion1]" - } + }, + "condition": "[parameters('DeployAnalyticsRule')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -690,7 +733,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "DNS_HighReverseDNSCount_detection_AnalyticalRules Analytics Rule with template version 3.0.1", + "description": "DNS_HighReverseDNSCount_detection_AnalyticalRules Analytics Rule with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject2').analyticRuleVersion2]", @@ -718,10 +761,10 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "DNS", "dataTypes": [ "DnsEvents" - ], - "connectorId": "DNS" + ] } ], "tactics": [ @@ -783,7 +826,8 @@ "contentProductId": "[variables('analyticRuleObject2')._analyticRulecontentProductId2]", "id": "[variables('analyticRuleObject2')._analyticRulecontentProductId2]", "version": "[variables('analyticRuleObject2').analyticRuleVersion2]" - } + }, + "condition": "[parameters('DeployAnalyticsRule')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -794,7 +838,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "DNS_Miners_AnalyticalRules Analytics Rule with template version 3.0.1", + "description": "DNS_Miners_AnalyticalRules Analytics Rule with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject3').analyticRuleVersion3]", @@ -822,10 +866,10 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "DNS", "dataTypes": [ "DnsEvents" - ], - "connectorId": "DNS" + ] } ], "tactics": [ @@ -904,7 +948,8 @@ "contentProductId": "[variables('analyticRuleObject3')._analyticRulecontentProductId3]", "id": "[variables('analyticRuleObject3')._analyticRulecontentProductId3]", "version": "[variables('analyticRuleObject3').analyticRuleVersion3]" - } + }, + "condition": "[parameters('DeployAnalyticsRule')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -915,7 +960,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "DNS_TorProxies_AnalyticalRules Analytics Rule with template version 3.0.1", + "description": "DNS_TorProxies_AnalyticalRules Analytics Rule with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject4').analyticRuleVersion4]", @@ -943,10 +988,10 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "DNS", "dataTypes": [ "DnsEvents" - ], - "connectorId": "DNS" + ] } ], "tactics": [ @@ -1025,7 +1070,8 @@ "contentProductId": "[variables('analyticRuleObject4')._analyticRulecontentProductId4]", "id": "[variables('analyticRuleObject4')._analyticRulecontentProductId4]", "version": "[variables('analyticRuleObject4').analyticRuleVersion4]" - } + }, + "condition": "[parameters('DeployAnalyticsRule')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -1036,7 +1082,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "NRT_DNS_Related_To_Mining_Pools_AnalyticalRules Analytics Rule with template version 3.0.1", + "description": "NRT_DNS_Related_To_Mining_Pools_AnalyticalRules Analytics Rule with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject5').analyticRuleVersion5]", @@ -1060,10 +1106,10 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "DNS", "dataTypes": [ "DnsEvents" - ], - "connectorId": "DNS" + ] } ], "tactics": [ @@ -1142,7 +1188,8 @@ "contentProductId": "[variables('analyticRuleObject5')._analyticRulecontentProductId5]", "id": "[variables('analyticRuleObject5')._analyticRulecontentProductId5]", "version": "[variables('analyticRuleObject5').analyticRuleVersion5]" - } + }, + "condition": "[parameters('DeployAnalyticsRule')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -1153,7 +1200,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "DNS_CommonlyAbusedTLDs_HuntingQueries Hunting Query with template version 3.0.1", + "description": "DNS_CommonlyAbusedTLDs_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject1').huntingQueryVersion1]", @@ -1227,7 +1274,8 @@ "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject1')._huntingQuerycontentId1,'-', '1.0.0')))]", "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject1')._huntingQuerycontentId1,'-', '1.0.0')))]", "version": "1.0.0" - } + }, + "condition": "[parameters('DeployHuntingQuery')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -1238,7 +1286,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "DNS_DomainAnomalousLookupIncrease_HuntingQueries Hunting Query with template version 3.0.1", + "description": "DNS_DomainAnomalousLookupIncrease_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject2').huntingQueryVersion2]", @@ -1312,7 +1360,8 @@ "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject2')._huntingQuerycontentId2,'-', '1.0.0')))]", "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject2')._huntingQuerycontentId2,'-', '1.0.0')))]", "version": "1.0.0" - } + }, + "condition": "[parameters('DeployHuntingQuery')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -1323,7 +1372,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "DNS_FullNameAnomalousLookupIncrease_HuntingQueries Hunting Query with template version 3.0.1", + "description": "DNS_FullNameAnomalousLookupIncrease_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject3').huntingQueryVersion3]", @@ -1397,7 +1446,8 @@ "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject3')._huntingQuerycontentId3,'-', '1.0.0')))]", "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject3')._huntingQuerycontentId3,'-', '1.0.0')))]", "version": "1.0.0" - } + }, + "condition": "[parameters('DeployHuntingQuery')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -1408,7 +1458,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "DNS_HighPercentNXDomainCount_HuntingQueries Hunting Query with template version 3.0.1", + "description": "DNS_HighPercentNXDomainCount_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject4').huntingQueryVersion4]", @@ -1482,7 +1532,8 @@ "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject4')._huntingQuerycontentId4,'-', '1.0.0')))]", "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject4')._huntingQuerycontentId4,'-', '1.0.0')))]", "version": "1.0.0" - } + }, + "condition": "[parameters('DeployHuntingQuery')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -1493,7 +1544,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "DNS_HighReverseDNSCount_HuntingQueries Hunting Query with template version 3.0.1", + "description": "DNS_HighReverseDNSCount_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject5').huntingQueryVersion5]", @@ -1567,7 +1618,8 @@ "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject5')._huntingQuerycontentId5,'-', '1.0.0')))]", "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject5')._huntingQuerycontentId5,'-', '1.0.0')))]", "version": "1.0.0" - } + }, + "condition": "[parameters('DeployHuntingQuery')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -1578,7 +1630,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "DNS_LongURILookup_HuntingQueries Hunting Query with template version 3.0.1", + "description": "DNS_LongURILookup_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject6').huntingQueryVersion6]", @@ -1652,7 +1704,8 @@ "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject6')._huntingQuerycontentId6,'-', '1.0.0')))]", "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject6')._huntingQuerycontentId6,'-', '1.0.0')))]", "version": "1.0.0" - } + }, + "condition": "[parameters('DeployHuntingQuery')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -1663,7 +1716,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "DNS_WannaCry_HuntingQueries Hunting Query with template version 3.0.1", + "description": "DNS_WannaCry_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject7').huntingQueryVersion7]", @@ -1737,7 +1790,8 @@ "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject7')._huntingQuerycontentId7,'-', '1.0.0')))]", "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject7')._huntingQuerycontentId7,'-', '1.0.0')))]", "version": "1.0.0" - } + }, + "condition": "[parameters('DeployHuntingQuery')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -1748,7 +1802,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Solorigate-DNS-Pattern_HuntingQueries Hunting Query with template version 3.0.1", + "description": "Solorigate-DNS-Pattern_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject8').huntingQueryVersion8]", @@ -1822,7 +1876,8 @@ "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject8')._huntingQuerycontentId8,'-', '1.0.0')))]", "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject8')._huntingQuerycontentId8,'-', '1.0.0')))]", "version": "1.0.0" - } + }, + "condition": "[parameters('DeployHuntingQuery')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -1833,7 +1888,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Solorigate-Encoded-Domain-URL_HuntingQueries Hunting Query with template version 3.0.1", + "description": "Solorigate-Encoded-Domain-URL_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject9').huntingQueryVersion9]", @@ -1907,19 +1962,20 @@ "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject9')._huntingQuerycontentId9,'-', '1.0.0')))]", "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject9')._huntingQuerycontentId9,'-', '1.0.0')))]", "version": "1.0.0" - } + }, + "condition": "[parameters('DeployHuntingQuery')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentPackages", "apiVersion": "2023-04-01-preview", "location": "[parameters('workspace-location')]", "properties": { - "version": "3.0.1", + "version": "3.2.2", "kind": "Solution", "contentSchemaVersion": "3.0.0", "displayName": "Windows Server DNS", "publisherDisplayName": "Microsoft Sentinel, Microsoft Corporation", - "descriptionHtml": "

Note: Please refer to the following before installing the solution:

\n

• Review the solution Release Notes

\n

• There may be known issues pertaining to this Solution, please refer to them before installing.

\n

The DNS solution for Microsoft Sentinel allows you to ingest DNS analytic and audit logs into Microsoft Sentinel. The DNS logs are collected only from Windows agents.

\n

Installing this solution will deploy two data connectors,

\n
    \n

  1. DNS via AMA - This data connector helps in ingesting Windows DNS logs into your Log Analytics Workspace using the new Azure Monitor Agent. Learn more about ingesting using the new Azure Monitor Agent here. Microsoft recommends using this Data Connector.

    \n
    2. \n

  2. DNS via Legacy Agent - This data connector helps in ingesting Windows DNS logs into your Log Analytics Workspace using the legacy Log Analytics agent.

    \n
    3. \n
\n

**NOTE**: Microsoft recommends Installation of DNS via AMA. Legacy connector uses the Log Analytics agent which is about to be deprecated by **Aug 31, 2024,** and thus should only be installed where AMA is not supported.\n

Data Connectors: 2, Workbooks: 1, Analytic Rules: 5, Hunting Queries: 9

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", + "descriptionHtml": "

Note: Please refer to the following before installing the solution:

\n

• Review the solution Release Notes

\n

• There may be known issues pertaining to this Solution, please refer to them before installing.

\n

The DNS solution for Microsoft Sentinel allows you to ingest DNS analytic and audit logs into Microsoft Sentinel. The DNS logs are collected only from Windows agents.

\n

Installing this solution will deploy two data connectors,

\n
    \n

  1. DNS via AMA - This data connector helps in ingesting Windows DNS logs into your Log Analytics Workspace using the new Azure Monitor Agent. Learn more about ingesting using the new Azure Monitor Agent here. Microsoft recommends using this Data Connector.

    \n
    2. \n

  2. DNS via Legacy Agent - This data connector helps in ingesting Windows DNS logs into your Log Analytics Workspace using the legacy Log Analytics agent.

    \n
    3. \n
\n

**NOTE**: Microsoft recommends Installation of DNS via AMA. Legacy connector uses the Log Analytics agent which is about to be deprecated by **Aug 31, 2024,** and thus should only be installed where AMA is not supported.\n

Data Connectors: 2, Workbooks: 1, Analytic Rules: 5, XDR Detections: 5, Hunting Queries: 9

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", "contentKind": "Solution", "contentProductId": "[variables('_solutioncontentProductId')]", "id": "[variables('_solutioncontentProductId')]", @@ -2028,6 +2084,31 @@ "kind": "HuntingQuery", "contentId": "[variables('huntingQueryObject9')._huntingQuerycontentId9]", "version": "[variables('huntingQueryObject9').huntingQueryVersion9]" + }, + { + "kind": "CustomDetection", + "contentId": "xdr-a0907abe-6925-4d90-af2b-c7e89dc201a6", + "version": "3.2.1" + }, + { + "kind": "CustomDetection", + "contentId": "xdr-15ae38a2-2e29-48f7-883f-863fb25a5a06", + "version": "3.2.1" + }, + { + "kind": "CustomDetection", + "contentId": "xdr-0d76e9cf-788d-4a69-ac7d-f234826b5bed", + "version": "3.2.1" + }, + { + "kind": "CustomDetection", + "contentId": "xdr-a83ef0f4-dace-4767-bce3-ebd32599d2a0", + "version": "3.2.1" + }, + { + "kind": "CustomDetection", + "contentId": "xdr-d5b32cd4-2328-43da-ab47-cd289c1f5efc", + "version": "3.2.1" } ] }, @@ -2042,6 +2123,967 @@ } }, "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', variables('_solutionId'))]" + }, + { + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "WindowsServerDNS-CD-xdr-a0907abe-6925-4d90-af2b-c7e89dc201a6", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "mode": "Incremental", + "expressionEvaluationOptions": { + "scope": "inner" + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "imports": { + "MicrosoftSecurity": { + "provider": "MicrosoftSecurity", + "version": "1.0.0" + } + }, + "resources": { + "detectionRule": { + "import": "MicrosoftSecurity", + "type": "Microsoft.Security/detectionRules@2026-06-01-preview", + "properties": { + "status": "disabled", + "schedule": { + "frequency": "P1D" + }, + "id": "[if(true(), 'xdr-a0907abe-6925-4d90-af2b-c7e89dc201a6', 'xdr-a0907abe-6925-4d90-af2b-c7e89dc201a6')]", + "queryCondition": { + "queryText": "let starttime = 10d;\nlet endtime = 1d;\nlet threshold = 100;\nlet nxDomainDnsEvents = DnsEvents\n// ResultCode 3 => 'NXDOMAIN'\n| where ResultCode == 3\n| where QueryType in~ (\"A\", \"AAAA\")\n| where ipv4_is_match(\"127.0.0.1\", ClientIP) == False\n| where Name !has \"/\"\n| where Name has \".\";\nnxDomainDnsEvents\n| where TimeGenerated > ago(endtime)\n// sld = Second Level Domain\n| extend sld = tostring(split(Name, \".\")[-2])\n| summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), dcount(sld), sampleNXDomainList=make_set(Name, 100) by ClientIP\n| where dcount_sld > threshold\n// Filter out previously seen IPs\n// Returns all the records from the left side that don't have matches from the right\n| join kind=leftanti (nxDomainDnsEvents\n | where TimeGenerated between(ago(starttime)..ago(endtime))\n | extend sld = tostring(split(Name, \".\")[-2])\n | summarize dcount(sld) by ClientIP, bin(TimeGenerated,1d)\n | where dcount_sld > threshold\n ) on ClientIP\n | order by dcount_sld desc" + }, + "displayName": "Potential DGA detected", + "detectionAction": { + "alertTemplate": { + "severity": "medium", + "entityMappings": { + "ips": [ + { + "id": "[if(true(), 'ip1', 'ip1')]", + "addressColumn": "ClientIP" + } + ] + }, + "description": "'Identifies clients with a high NXDomain count, which could be indicative of a DGA (cycling through possible C2 domains where most C2s are not live).\nAlerts are generated when a new IP address is seen (based on not being associated with NXDomain records in the prior 10-day baseline period).'", + "tactics": [ + { + "techniques": [ + { + "technique": "T1568" + }, + { + "technique": "T1008" + } + ], + "tactic": "CommandAndControl" + } + ], + "title": "Potential DGA detected" + } + }, + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-dns", + "packageVersion": "3.2.2", + "contentId": "xdr-a0907abe-6925-4d90-af2b-c7e89dc201a6", + "contentVersion": "3.2.1" + } + } + } + } + } + }, + "condition": "[parameters('DeployCustomDetection')]" + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-cd-',uniquestring('xdr-a0907abe-6925-4d90-af2b-c7e89dc201a6')))]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[resourceId('Microsoft.Resources/deployments', 'WindowsServerDNS-CD-xdr-a0907abe-6925-4d90-af2b-c7e89dc201a6')]", + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "'Identifies clients with a high NXDomain count, which could be indicative of a DGA (cycling through possible C2 domains where most C2s are not live).\nAlerts are generated when a new IP address is seen (based on not being associated with NXDomain records in the prior 10-day baseline period).'", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0", + "imports": { + "MicrosoftSecurity": { + "provider": "MicrosoftSecurity", + "version": "1.0.0" + } + }, + "resources": { + "detectionRule": { + "import": "MicrosoftSecurity", + "type": "Microsoft.Security/detectionRules@2026-06-01-preview", + "properties": { + "status": "disabled", + "schedule": { + "frequency": "P1D" + }, + "id": "[if(true(), 'xdr-a0907abe-6925-4d90-af2b-c7e89dc201a6', 'xdr-a0907abe-6925-4d90-af2b-c7e89dc201a6')]", + "queryCondition": { + "queryText": "let starttime = 10d;\nlet endtime = 1d;\nlet threshold = 100;\nlet nxDomainDnsEvents = DnsEvents\n// ResultCode 3 => 'NXDOMAIN'\n| where ResultCode == 3\n| where QueryType in~ (\"A\", \"AAAA\")\n| where ipv4_is_match(\"127.0.0.1\", ClientIP) == False\n| where Name !has \"/\"\n| where Name has \".\";\nnxDomainDnsEvents\n| where TimeGenerated > ago(endtime)\n// sld = Second Level Domain\n| extend sld = tostring(split(Name, \".\")[-2])\n| summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), dcount(sld), sampleNXDomainList=make_set(Name, 100) by ClientIP\n| where dcount_sld > threshold\n// Filter out previously seen IPs\n// Returns all the records from the left side that don't have matches from the right\n| join kind=leftanti (nxDomainDnsEvents\n | where TimeGenerated between(ago(starttime)..ago(endtime))\n | extend sld = tostring(split(Name, \".\")[-2])\n | summarize dcount(sld) by ClientIP, bin(TimeGenerated,1d)\n | where dcount_sld > threshold\n ) on ClientIP\n | order by dcount_sld desc" + }, + "displayName": "Potential DGA detected", + "detectionAction": { + "alertTemplate": { + "severity": "medium", + "entityMappings": { + "ips": [ + { + "id": "[if(true(), 'ip1', 'ip1')]", + "addressColumn": "ClientIP" + } + ] + }, + "description": "'Identifies clients with a high NXDomain count, which could be indicative of a DGA (cycling through possible C2 domains where most C2s are not live).\nAlerts are generated when a new IP address is seen (based on not being associated with NXDomain records in the prior 10-day baseline period).'", + "tactics": [ + { + "techniques": [ + { + "technique": "T1568" + }, + { + "technique": "T1008" + } + ], + "tactic": "CommandAndControl" + } + ], + "title": "Potential DGA detected" + } + }, + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-dns", + "packageVersion": "3.2.2", + "contentId": "xdr-a0907abe-6925-4d90-af2b-c7e89dc201a6", + "contentVersion": "3.2.1" + } + } + } + } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "xdr-a0907abe-6925-4d90-af2b-c7e89dc201a6", + "contentKind": "CustomDetection", + "displayName": "Potential DGA detected", + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-a0907abe-6925-4d90-af2b-c7e89dc201a6','-','3.2.1')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-a0907abe-6925-4d90-af2b-c7e89dc201a6','-','3.2.1')))]", + "version": "3.2.1", + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-dns", + "packageVersion": "3.2.2", + "contentId": "xdr-a0907abe-6925-4d90-af2b-c7e89dc201a6", + "contentVersion": "3.2.1", + "requiredWorkloads": [ + { + "dataTypes": [ + "DnsEvents" + ], + "workload": "sentinel" + } + ], + "requiredDataConnectors": [ + { + "dataTypes": [ + "DnsEvents" + ], + "connectorId": "DNS" + } + ] + } + }, + "condition": "[parameters('DeployCustomDetection')]" + }, + { + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "WindowsServerDNS-CD-xdr-15ae38a2-2e29-48f7-883f-863fb25a5a06", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "mode": "Incremental", + "expressionEvaluationOptions": { + "scope": "inner" + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "imports": { + "MicrosoftSecurity": { + "provider": "MicrosoftSecurity", + "version": "1.0.0" + } + }, + "resources": { + "detectionRule": { + "import": "MicrosoftSecurity", + "type": "Microsoft.Security/detectionRules@2026-06-01-preview", + "properties": { + "status": "disabled", + "schedule": { + "frequency": "P1D" + }, + "id": "[if(true(), 'xdr-15ae38a2-2e29-48f7-883f-863fb25a5a06', 'xdr-15ae38a2-2e29-48f7-883f-863fb25a5a06')]", + "queryCondition": { + "queryText": "let starttime = 8d;\nlet endtime = 1d;\nlet threshold = 10;\nDnsEvents\n| where TimeGenerated > ago(endtime)\n| where Name has \"in-addr.arpa\"\n| summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), dcount(Name), ReverseDNSLookup_List = make_set(Name,100) by ClientIP\n| where dcount_Name > threshold\n| project StartTimeUtc, EndTimeUtc, ClientIP , dcount_Name, ReverseDNSLookup_List\n// Filter out previously seen IPs\n// Returns all the records from the left side that don't have matches from the right\n| join kind=leftanti (DnsEvents\n | where TimeGenerated between(ago(starttime)..ago(endtime))\n | where Name has \"in-addr.arpa\"\n | summarize dcount(Name) by ClientIP, bin(TimeGenerated, 1d)\n | where dcount_Name > threshold\n | project ClientIP , dcount_Name\n) on ClientIP" + }, + "displayName": "Rare client observed with high reverse DNS lookup count", + "detectionAction": { + "alertTemplate": { + "severity": "medium", + "entityMappings": { + "ips": [ + { + "id": "[if(true(), 'ip1', 'ip1')]", + "addressColumn": "ClientIP" + } + ] + }, + "description": "'Identifies clients with a high reverse DNS counts that could be carrying out reconnaissance or discovery activity.\nAlerts are generated if the IP performing such reverse DNS lookups was not seen doing so in the preceding 7-day period.'", + "tactics": [ + { + "techniques": [ + { + "technique": "T1046" + } + ], + "tactic": "Discovery" + } + ], + "title": "Rare client observed with high reverse DNS lookup count" + } + }, + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-dns", + "packageVersion": "3.2.2", + "contentId": "xdr-15ae38a2-2e29-48f7-883f-863fb25a5a06", + "contentVersion": "3.2.1" + } + } + } + } + } + }, + "condition": "[parameters('DeployCustomDetection')]" + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-cd-',uniquestring('xdr-15ae38a2-2e29-48f7-883f-863fb25a5a06')))]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[resourceId('Microsoft.Resources/deployments', 'WindowsServerDNS-CD-xdr-15ae38a2-2e29-48f7-883f-863fb25a5a06')]", + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "'Identifies clients with a high reverse DNS counts that could be carrying out reconnaissance or discovery activity.\nAlerts are generated if the IP performing such reverse DNS lookups was not seen doing so in the preceding 7-day period.'", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0", + "imports": { + "MicrosoftSecurity": { + "provider": "MicrosoftSecurity", + "version": "1.0.0" + } + }, + "resources": { + "detectionRule": { + "import": "MicrosoftSecurity", + "type": "Microsoft.Security/detectionRules@2026-06-01-preview", + "properties": { + "status": "disabled", + "schedule": { + "frequency": "P1D" + }, + "id": "[if(true(), 'xdr-15ae38a2-2e29-48f7-883f-863fb25a5a06', 'xdr-15ae38a2-2e29-48f7-883f-863fb25a5a06')]", + "queryCondition": { + "queryText": "let starttime = 8d;\nlet endtime = 1d;\nlet threshold = 10;\nDnsEvents\n| where TimeGenerated > ago(endtime)\n| where Name has \"in-addr.arpa\"\n| summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), dcount(Name), ReverseDNSLookup_List = make_set(Name,100) by ClientIP\n| where dcount_Name > threshold\n| project StartTimeUtc, EndTimeUtc, ClientIP , dcount_Name, ReverseDNSLookup_List\n// Filter out previously seen IPs\n// Returns all the records from the left side that don't have matches from the right\n| join kind=leftanti (DnsEvents\n | where TimeGenerated between(ago(starttime)..ago(endtime))\n | where Name has \"in-addr.arpa\"\n | summarize dcount(Name) by ClientIP, bin(TimeGenerated, 1d)\n | where dcount_Name > threshold\n | project ClientIP , dcount_Name\n) on ClientIP" + }, + "displayName": "Rare client observed with high reverse DNS lookup count", + "detectionAction": { + "alertTemplate": { + "severity": "medium", + "entityMappings": { + "ips": [ + { + "id": "[if(true(), 'ip1', 'ip1')]", + "addressColumn": "ClientIP" + } + ] + }, + "description": "'Identifies clients with a high reverse DNS counts that could be carrying out reconnaissance or discovery activity.\nAlerts are generated if the IP performing such reverse DNS lookups was not seen doing so in the preceding 7-day period.'", + "tactics": [ + { + "techniques": [ + { + "technique": "T1046" + } + ], + "tactic": "Discovery" + } + ], + "title": "Rare client observed with high reverse DNS lookup count" + } + }, + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-dns", + "packageVersion": "3.2.2", + "contentId": "xdr-15ae38a2-2e29-48f7-883f-863fb25a5a06", + "contentVersion": "3.2.1" + } + } + } + } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "xdr-15ae38a2-2e29-48f7-883f-863fb25a5a06", + "contentKind": "CustomDetection", + "displayName": "Rare client observed with high reverse DNS lookup count", + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-15ae38a2-2e29-48f7-883f-863fb25a5a06','-','3.2.1')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-15ae38a2-2e29-48f7-883f-863fb25a5a06','-','3.2.1')))]", + "version": "3.2.1", + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-dns", + "packageVersion": "3.2.2", + "contentId": "xdr-15ae38a2-2e29-48f7-883f-863fb25a5a06", + "contentVersion": "3.2.1", + "requiredWorkloads": [ + { + "dataTypes": [ + "DnsEvents" + ], + "workload": "sentinel" + } + ], + "requiredDataConnectors": [ + { + "dataTypes": [ + "DnsEvents" + ], + "connectorId": "DNS" + } + ] + } + }, + "condition": "[parameters('DeployCustomDetection')]" + }, + { + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "WindowsServerDNS-CD-xdr-0d76e9cf-788d-4a69-ac7d-f234826b5bed", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "mode": "Incremental", + "expressionEvaluationOptions": { + "scope": "inner" + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "imports": { + "MicrosoftSecurity": { + "provider": "MicrosoftSecurity", + "version": "1.0.0" + } + }, + "resources": { + "detectionRule": { + "import": "MicrosoftSecurity", + "type": "Microsoft.Security/detectionRules@2026-06-01-preview", + "properties": { + "status": "disabled", + "schedule": { + "frequency": "P1D" + }, + "id": "[if(true(), 'xdr-0d76e9cf-788d-4a69-ac7d-f234826b5bed', 'xdr-0d76e9cf-788d-4a69-ac7d-f234826b5bed')]", + "queryCondition": { + "queryText": "DnsEvents\n| where Name contains \".\"\n| where Name has_any (\"monerohash.com\", \"do-dear.com\", \"xmrminerpro.com\", \"secumine.net\", \"xmrpool.com\", \"minexmr.org\", \"hashanywhere.com\",\n\"xmrget.com\", \"mininglottery.eu\", \"minergate.com\", \"moriaxmr.com\", \"multipooler.com\", \"moneropools.com\", \"xmrpool.eu\", \"coolmining.club\",\n\"supportxmr.com\", \"minexmr.com\", \"hashvault.pro\", \"xmrpool.net\", \"crypto-pool.fr\", \"xmr.pt\", \"miner.rocks\", \"walpool.com\", \"herominers.com\",\n\"gntl.co.uk\", \"semipool.com\", \"coinfoundry.org\", \"cryptoknight.cc\", \"fairhash.org\", \"baikalmine.com\", \"tubepool.xyz\", \"fairpool.xyz\", \"asiapool.io\",\n\"coinpoolit.webhop.me\", \"nanopool.org\", \"moneropool.com\", \"miner.center\", \"prohash.net\", \"poolto.be\", \"cryptoescrow.eu\", \"monerominers.net\", \"cryptonotepool.org\",\n\"extrmepool.org\", \"webcoin.me\", \"kippo.eu\", \"hashinvest.ws\", \"monero.farm\", \"supportxmr.com\", \"xmrpool.eu\", \"linux-repository-updates.com\", \"1gh.com\",\n\"dwarfpool.com\", \"hash-to-coins.com\", \"hashvault.pro\", \"pool-proxy.com\", \"hashfor.cash\", \"fairpool.cloud\", \"litecoinpool.org\", \"mineshaft.ml\", \"abcxyz.stream\",\n\"moneropool.ru\", \"cryptonotepool.org.uk\", \"extremepool.org\", \"extremehash.com\", \"hashinvest.net\", \"unipool.pro\", \"crypto-pools.org\", \"monero.net\",\n\"backup-pool.com\", \"mooo.com\", \"freeyy.me\", \"cryptonight.net\", \"shscrypto.net\")\n| extend HostName = iff(Computer has '.', substring(Computer,0,indexof(Computer,'.')),Computer)\n| extend DnsDomain = iff(Computer has '.', substring(Computer,indexof(Computer,'.')+1),\"\")" + }, + "displayName": "DNS events related to mining pools", + "detectionAction": { + "alertTemplate": { + "severity": "low", + "entityMappings": { + "ips": [ + { + "id": "[if(true(), 'ip1', 'ip1')]", + "addressColumn": "ClientIP" + } + ], + "hosts": [ + { + "id": "[if(true(), 'host1', 'host1')]", + "dnsDomainColumn": "DnsDomain", + "nameColumn": "HostName" + } + ] + }, + "description": "'Identifies IP addresses that may be performing DNS lookups associated with common currency mining pools.'", + "tactics": [ + { + "techniques": [ + { + "technique": "T1496" + } + ], + "tactic": "Impact" + } + ], + "title": "DNS events related to mining pools" + } + }, + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-dns", + "packageVersion": "3.2.2", + "contentId": "xdr-0d76e9cf-788d-4a69-ac7d-f234826b5bed", + "contentVersion": "3.2.1" + } + } + } + } + } + }, + "condition": "[parameters('DeployCustomDetection')]" + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-cd-',uniquestring('xdr-0d76e9cf-788d-4a69-ac7d-f234826b5bed')))]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[resourceId('Microsoft.Resources/deployments', 'WindowsServerDNS-CD-xdr-0d76e9cf-788d-4a69-ac7d-f234826b5bed')]", + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "'Identifies IP addresses that may be performing DNS lookups associated with common currency mining pools.'", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0", + "imports": { + "MicrosoftSecurity": { + "provider": "MicrosoftSecurity", + "version": "1.0.0" + } + }, + "resources": { + "detectionRule": { + "import": "MicrosoftSecurity", + "type": "Microsoft.Security/detectionRules@2026-06-01-preview", + "properties": { + "status": "disabled", + "schedule": { + "frequency": "P1D" + }, + "id": "[if(true(), 'xdr-0d76e9cf-788d-4a69-ac7d-f234826b5bed', 'xdr-0d76e9cf-788d-4a69-ac7d-f234826b5bed')]", + "queryCondition": { + "queryText": "DnsEvents\n| where Name contains \".\"\n| where Name has_any (\"monerohash.com\", \"do-dear.com\", \"xmrminerpro.com\", \"secumine.net\", \"xmrpool.com\", \"minexmr.org\", \"hashanywhere.com\",\n\"xmrget.com\", \"mininglottery.eu\", \"minergate.com\", \"moriaxmr.com\", \"multipooler.com\", \"moneropools.com\", \"xmrpool.eu\", \"coolmining.club\",\n\"supportxmr.com\", \"minexmr.com\", \"hashvault.pro\", \"xmrpool.net\", \"crypto-pool.fr\", \"xmr.pt\", \"miner.rocks\", \"walpool.com\", \"herominers.com\",\n\"gntl.co.uk\", \"semipool.com\", \"coinfoundry.org\", \"cryptoknight.cc\", \"fairhash.org\", \"baikalmine.com\", \"tubepool.xyz\", \"fairpool.xyz\", \"asiapool.io\",\n\"coinpoolit.webhop.me\", \"nanopool.org\", \"moneropool.com\", \"miner.center\", \"prohash.net\", \"poolto.be\", \"cryptoescrow.eu\", \"monerominers.net\", \"cryptonotepool.org\",\n\"extrmepool.org\", \"webcoin.me\", \"kippo.eu\", \"hashinvest.ws\", \"monero.farm\", \"supportxmr.com\", \"xmrpool.eu\", \"linux-repository-updates.com\", \"1gh.com\",\n\"dwarfpool.com\", \"hash-to-coins.com\", \"hashvault.pro\", \"pool-proxy.com\", \"hashfor.cash\", \"fairpool.cloud\", \"litecoinpool.org\", \"mineshaft.ml\", \"abcxyz.stream\",\n\"moneropool.ru\", \"cryptonotepool.org.uk\", \"extremepool.org\", \"extremehash.com\", \"hashinvest.net\", \"unipool.pro\", \"crypto-pools.org\", \"monero.net\",\n\"backup-pool.com\", \"mooo.com\", \"freeyy.me\", \"cryptonight.net\", \"shscrypto.net\")\n| extend HostName = iff(Computer has '.', substring(Computer,0,indexof(Computer,'.')),Computer)\n| extend DnsDomain = iff(Computer has '.', substring(Computer,indexof(Computer,'.')+1),\"\")" + }, + "displayName": "DNS events related to mining pools", + "detectionAction": { + "alertTemplate": { + "severity": "low", + "entityMappings": { + "ips": [ + { + "id": "[if(true(), 'ip1', 'ip1')]", + "addressColumn": "ClientIP" + } + ], + "hosts": [ + { + "id": "[if(true(), 'host1', 'host1')]", + "dnsDomainColumn": "DnsDomain", + "nameColumn": "HostName" + } + ] + }, + "description": "'Identifies IP addresses that may be performing DNS lookups associated with common currency mining pools.'", + "tactics": [ + { + "techniques": [ + { + "technique": "T1496" + } + ], + "tactic": "Impact" + } + ], + "title": "DNS events related to mining pools" + } + }, + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-dns", + "packageVersion": "3.2.2", + "contentId": "xdr-0d76e9cf-788d-4a69-ac7d-f234826b5bed", + "contentVersion": "3.2.1" + } + } + } + } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "xdr-0d76e9cf-788d-4a69-ac7d-f234826b5bed", + "contentKind": "CustomDetection", + "displayName": "DNS events related to mining pools", + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-0d76e9cf-788d-4a69-ac7d-f234826b5bed','-','3.2.1')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-0d76e9cf-788d-4a69-ac7d-f234826b5bed','-','3.2.1')))]", + "version": "3.2.1", + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-dns", + "packageVersion": "3.2.2", + "contentId": "xdr-0d76e9cf-788d-4a69-ac7d-f234826b5bed", + "contentVersion": "3.2.1", + "requiredWorkloads": [ + { + "dataTypes": [ + "DnsEvents" + ], + "workload": "sentinel" + } + ], + "requiredDataConnectors": [ + { + "dataTypes": [ + "DnsEvents" + ], + "connectorId": "DNS" + } + ] + } + }, + "condition": "[parameters('DeployCustomDetection')]" + }, + { + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "WindowsServerDNS-CD-xdr-a83ef0f4-dace-4767-bce3-ebd32599d2a0", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "mode": "Incremental", + "expressionEvaluationOptions": { + "scope": "inner" + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "imports": { + "MicrosoftSecurity": { + "provider": "MicrosoftSecurity", + "version": "1.0.0" + } + }, + "resources": { + "detectionRule": { + "import": "MicrosoftSecurity", + "type": "Microsoft.Security/detectionRules@2026-06-01-preview", + "properties": { + "status": "disabled", + "schedule": { + "frequency": "P1D" + }, + "id": "[if(true(), 'xdr-a83ef0f4-dace-4767-bce3-ebd32599d2a0', 'xdr-a83ef0f4-dace-4767-bce3-ebd32599d2a0')]", + "queryCondition": { + "queryText": "DnsEvents\n| where Name contains \".\"\n| where Name has_any (\"tor2web.org\", \"tor2web.com\", \"torlink.co\", \"onion.to\", \"onion.ink\", \"onion.cab\", \"onion.nu\", \"onion.link\",\n\"onion.it\", \"onion.city\", \"onion.direct\", \"onion.top\", \"onion.casa\", \"onion.plus\", \"onion.rip\", \"onion.dog\", \"tor2web.fi\",\n\"tor2web.blutmagie.de\", \"onion.sh\", \"onion.lu\", \"onion.pet\", \"t2w.pw\", \"tor2web.ae.org\", \"tor2web.io\", \"tor2web.xyz\", \"onion.lt\",\n\"s1.tor-gateways.de\", \"s2.tor-gateways.de\", \"s3.tor-gateways.de\", \"s4.tor-gateways.de\", \"s5.tor-gateways.de\", \"hiddenservice.net\")\n| extend HostName = iff(Computer has '.', substring(Computer,0,indexof(Computer,'.')),Computer)\n| extend DnsDomain = iff(Computer has '.', substring(Computer,indexof(Computer,'.')+1),\"\")" + }, + "displayName": "DNS events related to ToR proxies", + "detectionAction": { + "alertTemplate": { + "severity": "low", + "entityMappings": { + "ips": [ + { + "id": "[if(true(), 'ip1', 'ip1')]", + "addressColumn": "ClientIP" + } + ], + "hosts": [ + { + "id": "[if(true(), 'host1', 'host1')]", + "dnsDomainColumn": "DnsDomain", + "nameColumn": "HostName" + } + ] + }, + "description": "'Identifies IP addresses performing DNS lookups associated with common ToR proxies.'", + "tactics": [ + { + "techniques": [ + { + "technique": "T1048" + } + ], + "tactic": "Exfiltration" + } + ], + "title": "DNS events related to ToR proxies" + } + }, + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-dns", + "packageVersion": "3.2.2", + "contentId": "xdr-a83ef0f4-dace-4767-bce3-ebd32599d2a0", + "contentVersion": "3.2.1" + } + } + } + } + } + }, + "condition": "[parameters('DeployCustomDetection')]" + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-cd-',uniquestring('xdr-a83ef0f4-dace-4767-bce3-ebd32599d2a0')))]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[resourceId('Microsoft.Resources/deployments', 'WindowsServerDNS-CD-xdr-a83ef0f4-dace-4767-bce3-ebd32599d2a0')]", + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "'Identifies IP addresses performing DNS lookups associated with common ToR proxies.'", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0", + "imports": { + "MicrosoftSecurity": { + "provider": "MicrosoftSecurity", + "version": "1.0.0" + } + }, + "resources": { + "detectionRule": { + "import": "MicrosoftSecurity", + "type": "Microsoft.Security/detectionRules@2026-06-01-preview", + "properties": { + "status": "disabled", + "schedule": { + "frequency": "P1D" + }, + "id": "[if(true(), 'xdr-a83ef0f4-dace-4767-bce3-ebd32599d2a0', 'xdr-a83ef0f4-dace-4767-bce3-ebd32599d2a0')]", + "queryCondition": { + "queryText": "DnsEvents\n| where Name contains \".\"\n| where Name has_any (\"tor2web.org\", \"tor2web.com\", \"torlink.co\", \"onion.to\", \"onion.ink\", \"onion.cab\", \"onion.nu\", \"onion.link\",\n\"onion.it\", \"onion.city\", \"onion.direct\", \"onion.top\", \"onion.casa\", \"onion.plus\", \"onion.rip\", \"onion.dog\", \"tor2web.fi\",\n\"tor2web.blutmagie.de\", \"onion.sh\", \"onion.lu\", \"onion.pet\", \"t2w.pw\", \"tor2web.ae.org\", \"tor2web.io\", \"tor2web.xyz\", \"onion.lt\",\n\"s1.tor-gateways.de\", \"s2.tor-gateways.de\", \"s3.tor-gateways.de\", \"s4.tor-gateways.de\", \"s5.tor-gateways.de\", \"hiddenservice.net\")\n| extend HostName = iff(Computer has '.', substring(Computer,0,indexof(Computer,'.')),Computer)\n| extend DnsDomain = iff(Computer has '.', substring(Computer,indexof(Computer,'.')+1),\"\")" + }, + "displayName": "DNS events related to ToR proxies", + "detectionAction": { + "alertTemplate": { + "severity": "low", + "entityMappings": { + "ips": [ + { + "id": "[if(true(), 'ip1', 'ip1')]", + "addressColumn": "ClientIP" + } + ], + "hosts": [ + { + "id": "[if(true(), 'host1', 'host1')]", + "dnsDomainColumn": "DnsDomain", + "nameColumn": "HostName" + } + ] + }, + "description": "'Identifies IP addresses performing DNS lookups associated with common ToR proxies.'", + "tactics": [ + { + "techniques": [ + { + "technique": "T1048" + } + ], + "tactic": "Exfiltration" + } + ], + "title": "DNS events related to ToR proxies" + } + }, + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-dns", + "packageVersion": "3.2.2", + "contentId": "xdr-a83ef0f4-dace-4767-bce3-ebd32599d2a0", + "contentVersion": "3.2.1" + } + } + } + } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "xdr-a83ef0f4-dace-4767-bce3-ebd32599d2a0", + "contentKind": "CustomDetection", + "displayName": "DNS events related to ToR proxies", + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-a83ef0f4-dace-4767-bce3-ebd32599d2a0','-','3.2.1')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-a83ef0f4-dace-4767-bce3-ebd32599d2a0','-','3.2.1')))]", + "version": "3.2.1", + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-dns", + "packageVersion": "3.2.2", + "contentId": "xdr-a83ef0f4-dace-4767-bce3-ebd32599d2a0", + "contentVersion": "3.2.1", + "requiredWorkloads": [ + { + "dataTypes": [ + "DnsEvents" + ], + "workload": "sentinel" + } + ], + "requiredDataConnectors": [ + { + "dataTypes": [ + "DnsEvents" + ], + "connectorId": "DNS" + } + ] + } + }, + "condition": "[parameters('DeployCustomDetection')]" + }, + { + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "WindowsServerDNS-CD-xdr-d5b32cd4-2328-43da-ab47-cd289c1f5efc", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "mode": "Incremental", + "expressionEvaluationOptions": { + "scope": "inner" + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "imports": { + "MicrosoftSecurity": { + "provider": "MicrosoftSecurity", + "version": "1.0.0" + } + }, + "resources": { + "detectionRule": { + "import": "MicrosoftSecurity", + "type": "Microsoft.Security/detectionRules@2026-06-01-preview", + "properties": { + "status": "disabled", + "schedule": { + "frequency": "PT5M" + }, + "id": "[if(true(), 'xdr-d5b32cd4-2328-43da-ab47-cd289c1f5efc', 'xdr-d5b32cd4-2328-43da-ab47-cd289c1f5efc')]", + "queryCondition": { + "queryText": "DnsEvents\n| where Name contains \".\"\n| where Name has_any (\"monerohash.com\", \"do-dear.com\", \"xmrminerpro.com\", \"secumine.net\", \"xmrpool.com\", \"minexmr.org\", \"hashanywhere.com\",\n\"xmrget.com\", \"mininglottery.eu\", \"minergate.com\", \"moriaxmr.com\", \"multipooler.com\", \"moneropools.com\", \"xmrpool.eu\", \"coolmining.club\",\n\"supportxmr.com\", \"minexmr.com\", \"hashvault.pro\", \"xmrpool.net\", \"crypto-pool.fr\", \"xmr.pt\", \"miner.rocks\", \"walpool.com\", \"herominers.com\",\n\"gntl.co.uk\", \"semipool.com\", \"coinfoundry.org\", \"cryptoknight.cc\", \"fairhash.org\", \"baikalmine.com\", \"tubepool.xyz\", \"fairpool.xyz\", \"asiapool.io\",\n\"coinpoolit.webhop.me\", \"nanopool.org\", \"moneropool.com\", \"miner.center\", \"prohash.net\", \"poolto.be\", \"cryptoescrow.eu\", \"monerominers.net\", \"cryptonotepool.org\",\n\"extrmepool.org\", \"webcoin.me\", \"kippo.eu\", \"hashinvest.ws\", \"monero.farm\", \"supportxmr.com\", \"xmrpool.eu\", \"linux-repository-updates.com\", \"1gh.com\",\n\"dwarfpool.com\", \"hash-to-coins.com\", \"hashvault.pro\", \"pool-proxy.com\", \"hashfor.cash\", \"fairpool.cloud\", \"litecoinpool.org\", \"mineshaft.ml\", \"abcxyz.stream\",\n\"moneropool.ru\", \"cryptonotepool.org.uk\", \"extremepool.org\", \"extremehash.com\", \"hashinvest.net\", \"unipool.pro\", \"crypto-pools.org\", \"monero.net\",\n\"backup-pool.com\", \"mooo.com\", \"freeyy.me\", \"cryptonight.net\", \"shscrypto.net\")\n| extend HostName = iff(Computer has '.', substring(Computer,0,indexof(Computer,'.')),Computer)\n| extend DnsDomain = iff(Computer has '.', substring(Computer,indexof(Computer,'.')+1),\"\")" + }, + "displayName": "NRT DNS events related to mining pools", + "detectionAction": { + "alertTemplate": { + "severity": "low", + "entityMappings": { + "ips": [ + { + "id": "[if(true(), 'ip1', 'ip1')]", + "addressColumn": "ClientIP" + } + ], + "hosts": [ + { + "id": "[if(true(), 'host1', 'host1')]", + "dnsDomainColumn": "DnsDomain", + "nameColumn": "HostName" + } + ] + }, + "description": "'Identifies IP addresses that may be performing DNS lookups associated with common currency mining pools.'", + "tactics": [ + { + "techniques": [ + { + "technique": "T1496" + } + ], + "tactic": "Impact" + } + ], + "title": "NRT DNS events related to mining pools" + } + }, + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-dns", + "packageVersion": "3.2.2", + "contentId": "xdr-d5b32cd4-2328-43da-ab47-cd289c1f5efc", + "contentVersion": "3.2.1" + } + } + } + } + } + }, + "condition": "[parameters('DeployCustomDetection')]" + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-cd-',uniquestring('xdr-d5b32cd4-2328-43da-ab47-cd289c1f5efc')))]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[resourceId('Microsoft.Resources/deployments', 'WindowsServerDNS-CD-xdr-d5b32cd4-2328-43da-ab47-cd289c1f5efc')]", + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "'Identifies IP addresses that may be performing DNS lookups associated with common currency mining pools.'", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0", + "imports": { + "MicrosoftSecurity": { + "provider": "MicrosoftSecurity", + "version": "1.0.0" + } + }, + "resources": { + "detectionRule": { + "import": "MicrosoftSecurity", + "type": "Microsoft.Security/detectionRules@2026-06-01-preview", + "properties": { + "status": "disabled", + "schedule": { + "frequency": "PT5M" + }, + "id": "[if(true(), 'xdr-d5b32cd4-2328-43da-ab47-cd289c1f5efc', 'xdr-d5b32cd4-2328-43da-ab47-cd289c1f5efc')]", + "queryCondition": { + "queryText": "DnsEvents\n| where Name contains \".\"\n| where Name has_any (\"monerohash.com\", \"do-dear.com\", \"xmrminerpro.com\", \"secumine.net\", \"xmrpool.com\", \"minexmr.org\", \"hashanywhere.com\",\n\"xmrget.com\", \"mininglottery.eu\", \"minergate.com\", \"moriaxmr.com\", \"multipooler.com\", \"moneropools.com\", \"xmrpool.eu\", \"coolmining.club\",\n\"supportxmr.com\", \"minexmr.com\", \"hashvault.pro\", \"xmrpool.net\", \"crypto-pool.fr\", \"xmr.pt\", \"miner.rocks\", \"walpool.com\", \"herominers.com\",\n\"gntl.co.uk\", \"semipool.com\", \"coinfoundry.org\", \"cryptoknight.cc\", \"fairhash.org\", \"baikalmine.com\", \"tubepool.xyz\", \"fairpool.xyz\", \"asiapool.io\",\n\"coinpoolit.webhop.me\", \"nanopool.org\", \"moneropool.com\", \"miner.center\", \"prohash.net\", \"poolto.be\", \"cryptoescrow.eu\", \"monerominers.net\", \"cryptonotepool.org\",\n\"extrmepool.org\", \"webcoin.me\", \"kippo.eu\", \"hashinvest.ws\", \"monero.farm\", \"supportxmr.com\", \"xmrpool.eu\", \"linux-repository-updates.com\", \"1gh.com\",\n\"dwarfpool.com\", \"hash-to-coins.com\", \"hashvault.pro\", \"pool-proxy.com\", \"hashfor.cash\", \"fairpool.cloud\", \"litecoinpool.org\", \"mineshaft.ml\", \"abcxyz.stream\",\n\"moneropool.ru\", \"cryptonotepool.org.uk\", \"extremepool.org\", \"extremehash.com\", \"hashinvest.net\", \"unipool.pro\", \"crypto-pools.org\", \"monero.net\",\n\"backup-pool.com\", \"mooo.com\", \"freeyy.me\", \"cryptonight.net\", \"shscrypto.net\")\n| extend HostName = iff(Computer has '.', substring(Computer,0,indexof(Computer,'.')),Computer)\n| extend DnsDomain = iff(Computer has '.', substring(Computer,indexof(Computer,'.')+1),\"\")" + }, + "displayName": "NRT DNS events related to mining pools", + "detectionAction": { + "alertTemplate": { + "severity": "low", + "entityMappings": { + "ips": [ + { + "id": "[if(true(), 'ip1', 'ip1')]", + "addressColumn": "ClientIP" + } + ], + "hosts": [ + { + "id": "[if(true(), 'host1', 'host1')]", + "dnsDomainColumn": "DnsDomain", + "nameColumn": "HostName" + } + ] + }, + "description": "'Identifies IP addresses that may be performing DNS lookups associated with common currency mining pools.'", + "tactics": [ + { + "techniques": [ + { + "technique": "T1496" + } + ], + "tactic": "Impact" + } + ], + "title": "NRT DNS events related to mining pools" + } + }, + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-dns", + "packageVersion": "3.2.2", + "contentId": "xdr-d5b32cd4-2328-43da-ab47-cd289c1f5efc", + "contentVersion": "3.2.1" + } + } + } + } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "xdr-d5b32cd4-2328-43da-ab47-cd289c1f5efc", + "contentKind": "CustomDetection", + "displayName": "NRT DNS events related to mining pools", + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-d5b32cd4-2328-43da-ab47-cd289c1f5efc','-','3.2.1')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-d5b32cd4-2328-43da-ab47-cd289c1f5efc','-','3.2.1')))]", + "version": "3.2.1", + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-dns", + "packageVersion": "3.2.2", + "contentId": "xdr-d5b32cd4-2328-43da-ab47-cd289c1f5efc", + "contentVersion": "3.2.1", + "requiredWorkloads": [ + { + "dataTypes": [ + "DnsEvents" + ], + "workload": "sentinel" + } + ], + "requiredDataConnectors": [ + { + "dataTypes": [ + "DnsEvents" + ], + "connectorId": "DNS" + } + ] + } + }, + "condition": "[parameters('DeployCustomDetection')]" + }, + { + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "pid-2e4218db-bed8-438a-a490-94dbd06761d1-partnercenter", + "properties": { + "mode": "Incremental", + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "resources": [] + } + } } ], "outputs": {} diff --git a/Solutions/Windows Server DNS/Package/testParameters.json b/Solutions/Windows Server DNS/Package/testParameters.json index 5fd17e01582..a3b1987967b 100644 --- a/Solutions/Windows Server DNS/Package/testParameters.json +++ b/Solutions/Windows Server DNS/Package/testParameters.json @@ -28,5 +28,40 @@ "metadata": { "description": "Name for the workbook" } + }, + "DeployAnalyticsRule": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Deploy the Microsoft Sentinel analytic rules carried by this solution (ContentKind AnalyticsRule and its AnalyticsRuleTemplate registration face)." + } + }, + "DeployWorkbook": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Deploy the Microsoft Sentinel workbook content and its Content Hub registration carried by this solution (ContentKind Workbook and WorkbookTemplate)." + } + }, + "DeployDataConnector": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Deploy the data connectors carried by this solution, together with their metadata and catalog entries (ContentKind DataConnector, ResourceDataConnector and DataType)." + } + }, + "DeployCustomDetection": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Deploy the XDR-native custom detection resources and their Content Hub registrations (ContentKind CustomDetection and CustomDetectionTemplate). Independent of DeployAnalyticsRule: both kinds can be selected together. Existing analytic-rule instances are not disabled or removed. CD enabled or disabled status is controlled separately from this deployment switch." + } + }, + "DeployHuntingQuery": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Deploy the Microsoft Sentinel hunting queries carried by this solution." + } } } diff --git a/Solutions/Windows Server DNS/ReleaseNotes.md b/Solutions/Windows Server DNS/ReleaseNotes.md index b819867fe59..b879fb4b087 100644 --- a/Solutions/Windows Server DNS/ReleaseNotes.md +++ b/Solutions/Windows Server DNS/ReleaseNotes.md @@ -1,4 +1,5 @@ | **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** | |-------------|--------------------------------|--------------------------------------------------------------------| +| 3.2.2 | 20-10-2026 | Added disabled Defender XDR Custom Detections corresponding to the solution's **Analytic Rules**, including the NRT rule. Defender Workbook drafts requiring review are excluded from packaging. | | 3.0.1 | 19-03-2024 | Updated Entity Mappings of **Analytic Rules** | | 3.0.0 | 18-09-2023 | Windows DNS Events via AMA **Data Connector** now General Availability | diff --git a/Solutions/Windows Server DNS/SolutionMetadata.json b/Solutions/Windows Server DNS/SolutionMetadata.json index b4d15a34bea..005959b55b3 100644 --- a/Solutions/Windows Server DNS/SolutionMetadata.json +++ b/Solutions/Windows Server DNS/SolutionMetadata.json @@ -1,7 +1,9 @@ { + "trackingId": "pid-2e4218db-bed8-438a-a490-94dbd06761d1-partnercenter", "publisherId": "azuresentinel", "offerId": "azure-sentinel-solution-dns", "firstPublishDate": "2022-05-11", + "version": "3.2.2", "providers": ["Microsoft"], "categories": { "domains" : ["Networking"] diff --git a/Solutions/Windows Server DNS/XDR Detections/DNS_HighNXDomainCount_detection.yaml b/Solutions/Windows Server DNS/XDR Detections/DNS_HighNXDomainCount_detection.yaml new file mode 100644 index 00000000000..6fa8f293a76 --- /dev/null +++ b/Solutions/Windows Server DNS/XDR Detections/DNS_HighNXDomainCount_detection.yaml @@ -0,0 +1,99 @@ +schemaVersion: 1.0.0 +version: 3.2.1 +kind: CustomDetection +resourceType: Microsoft.Security/detectionRules +apiVersion: 2026-06-01-preview +requiredDataConnectors: +- connectorId: DNS + dataTypes: + - DnsEvents +contentProvenance: + requiredWorkloads: + - workload: sentinel + dataTypes: + - DnsEvents + requiredDataConnectors: + - connectorId: DNS + dataTypes: + - DnsEvents + dependencyReviewRequired: false + source: + platform: Microsoft Sentinel + kind: AnalyticsRule + id: a0907abe-6925-4d90-af2b-c7e89dc201a6 + path: Analytic Rules/DNS_HighNXDomainCount_detection.yaml + version: 1.0.3 + querySha256: 0622eadecb5446af64bf66fdf0258e232d4dfd924acd7eb6737546f00272689e + schedule: + queryFrequency: 1d + queryPeriod: 10d + conversion: + tool: sentinel-to-xdr-migration + version: 0.1.0 + status: converted + reviewRequired: false + reviewReasons: [] + requiredWorkloads: + - sentinel + warnings: + - 'Schedule assessment: source frequency=1d, lookback=10d; target frequency=P1D, native lookback=unknown/unconfigured; + mixed, Sentinel-only, or unknown query surface; no custom lookback is configured in the payload. See https://learn.microsoft.com/en-us/defender-xdr/custom-detection-rules#lookback' + informational: [] + errors: [] + originalTactics: + - CommandAndControl + originalTechniques: + - T1568 + - T1008 + reviewScope: + sourceDocumentSha256: 8003423a63470cd243d5b96c19535e5dd210f143fdf0c22239e839394ca4827f + targetQuerySha256: 7a7fe030d764d8ede9abb3bf000e6252a1a573361aced64213b393a0744eb200 +properties: + id: xdr-a0907abe-6925-4d90-af2b-c7e89dc201a6 + displayName: Potential DGA detected + status: disabled + queryCondition: + queryText: |- + let starttime = 10d; + let endtime = 1d; + let threshold = 100; + let nxDomainDnsEvents = DnsEvents + // ResultCode 3 => 'NXDOMAIN' + | where ResultCode == 3 + | where QueryType in~ ("A", "AAAA") + | where ipv4_is_match("127.0.0.1", ClientIP) == False + | where Name !has "/" + | where Name has "."; + nxDomainDnsEvents + | where TimeGenerated > ago(endtime) + // sld = Second Level Domain + | extend sld = tostring(split(Name, ".")[-2]) + | summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), dcount(sld), sampleNXDomainList=make_set(Name, 100) by ClientIP + | where dcount_sld > threshold + // Filter out previously seen IPs + // Returns all the records from the left side that don't have matches from the right + | join kind=leftanti (nxDomainDnsEvents + | where TimeGenerated between(ago(starttime)..ago(endtime)) + | extend sld = tostring(split(Name, ".")[-2]) + | summarize dcount(sld) by ClientIP, bin(TimeGenerated,1d) + | where dcount_sld > threshold + ) on ClientIP + | order by dcount_sld desc + schedule: + frequency: P1D + detectionAction: + alertTemplate: + title: Potential DGA detected + description: |- + 'Identifies clients with a high NXDomain count, which could be indicative of a DGA (cycling through possible C2 domains where most C2s are not live). + Alerts are generated when a new IP address is seen (based on not being associated with NXDomain records in the prior 10-day baseline period).' + severity: medium + entityMappings: + ips: + - id: ip1 + addressColumn: ClientIP + tactics: + - tactic: CommandAndControl + techniques: + - technique: T1568 + - technique: T1008 diff --git a/Solutions/Windows Server DNS/XDR Detections/DNS_HighReverseDNSCount_detection.yaml b/Solutions/Windows Server DNS/XDR Detections/DNS_HighReverseDNSCount_detection.yaml new file mode 100644 index 00000000000..2bbfe5912f8 --- /dev/null +++ b/Solutions/Windows Server DNS/XDR Detections/DNS_HighReverseDNSCount_detection.yaml @@ -0,0 +1,90 @@ +schemaVersion: 1.0.0 +version: 3.2.1 +kind: CustomDetection +resourceType: Microsoft.Security/detectionRules +apiVersion: 2026-06-01-preview +requiredDataConnectors: +- connectorId: DNS + dataTypes: + - DnsEvents +contentProvenance: + requiredWorkloads: + - workload: sentinel + dataTypes: + - DnsEvents + requiredDataConnectors: + - connectorId: DNS + dataTypes: + - DnsEvents + dependencyReviewRequired: false + source: + platform: Microsoft Sentinel + kind: AnalyticsRule + id: 15ae38a2-2e29-48f7-883f-863fb25a5a06 + path: Analytic Rules/DNS_HighReverseDNSCount_detection.yaml + version: 1.0.2 + querySha256: 8e7021add8eea1f0b013e7c629906d9018a7b7610929729a50f96881d12d78ec + schedule: + queryFrequency: 1d + queryPeriod: 8d + conversion: + tool: sentinel-to-xdr-migration + version: 0.1.0 + status: converted + reviewRequired: false + reviewReasons: [] + requiredWorkloads: + - sentinel + warnings: + - 'Schedule assessment: source frequency=1d, lookback=8d; target frequency=P1D, native lookback=unknown/unconfigured; + mixed, Sentinel-only, or unknown query surface; no custom lookback is configured in the payload. See https://learn.microsoft.com/en-us/defender-xdr/custom-detection-rules#lookback' + informational: [] + errors: [] + originalTactics: + - Discovery + originalTechniques: + - T1046 + reviewScope: + sourceDocumentSha256: 080129a727eb2ef9c3028ebb2cc514e064b8c897f6ac91e5d24c21fd0d95d646 + targetQuerySha256: 4ba26136b0e06ffa7b4a765556b78f85a9a643737b0e2b10d0af0393a838d2be +properties: + id: xdr-15ae38a2-2e29-48f7-883f-863fb25a5a06 + displayName: Rare client observed with high reverse DNS lookup count + status: disabled + queryCondition: + queryText: |- + let starttime = 8d; + let endtime = 1d; + let threshold = 10; + DnsEvents + | where TimeGenerated > ago(endtime) + | where Name has "in-addr.arpa" + | summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), dcount(Name), ReverseDNSLookup_List = make_set(Name,100) by ClientIP + | where dcount_Name > threshold + | project StartTimeUtc, EndTimeUtc, ClientIP , dcount_Name, ReverseDNSLookup_List + // Filter out previously seen IPs + // Returns all the records from the left side that don't have matches from the right + | join kind=leftanti (DnsEvents + | where TimeGenerated between(ago(starttime)..ago(endtime)) + | where Name has "in-addr.arpa" + | summarize dcount(Name) by ClientIP, bin(TimeGenerated, 1d) + | where dcount_Name > threshold + | project ClientIP , dcount_Name + ) on ClientIP + schedule: + frequency: P1D + detectionAction: + alertTemplate: + title: Rare client observed with high reverse DNS lookup count + description: |- + 'Identifies clients with a high reverse DNS counts that could be carrying out reconnaissance or discovery activity. + Alerts are generated if the IP performing such reverse DNS lookups was not seen doing so in the preceding 7-day period.' + severity: medium + entityMappings: + ips: + - id: ip1 + addressColumn: ClientIP + tactics: + - tactic: Discovery + techniques: + - technique: T1046 diff --git a/Solutions/Windows Server DNS/XDR Detections/DNS_Miners.yaml b/Solutions/Windows Server DNS/XDR Detections/DNS_Miners.yaml new file mode 100644 index 00000000000..f6acd418317 --- /dev/null +++ b/Solutions/Windows Server DNS/XDR Detections/DNS_Miners.yaml @@ -0,0 +1,89 @@ +schemaVersion: 1.0.0 +version: 3.2.1 +kind: CustomDetection +resourceType: Microsoft.Security/detectionRules +apiVersion: 2026-06-01-preview +requiredDataConnectors: +- connectorId: DNS + dataTypes: + - DnsEvents +contentProvenance: + requiredWorkloads: + - workload: sentinel + dataTypes: + - DnsEvents + requiredDataConnectors: + - connectorId: DNS + dataTypes: + - DnsEvents + dependencyReviewRequired: false + source: + platform: Microsoft Sentinel + kind: AnalyticsRule + id: 0d76e9cf-788d-4a69-ac7d-f234826b5bed + path: Analytic Rules/DNS_Miners.yaml + version: 1.0.3 + querySha256: 89963454c2b89b7c539c86e7185dfc3d835314ed6afaf74ec985f7812328bb09 + schedule: + queryFrequency: 1d + queryPeriod: 1d + conversion: + tool: sentinel-to-xdr-migration + version: 0.1.0 + status: converted + reviewRequired: false + reviewReasons: [] + requiredWorkloads: + - sentinel + warnings: + - 'Schedule assessment: source frequency=1d, lookback=1d; target frequency=P1D, native lookback=unknown/unconfigured; + mixed, Sentinel-only, or unknown query surface; no custom lookback is configured in the payload. See https://learn.microsoft.com/en-us/defender-xdr/custom-detection-rules#lookback' + informational: + - Host.FullName `Computer` is safely represented by retained nameColumn `HostName` and dnsDomainColumn `DnsDomain`; the + query explicitly decomposes that same full name. No fullNameColumn is emitted + errors: [] + originalTactics: + - Impact + originalTechniques: + - T1496 + reviewScope: + sourceDocumentSha256: 5460ea90e5c301b86503942d4be18798391bbd387b0f7f740dfcae50fc6b9e25 + targetQuerySha256: 8ddd0a6aab7b19b0b1348888677546d86e89fcf9d34144d8e5155707664afe96 +properties: + id: xdr-0d76e9cf-788d-4a69-ac7d-f234826b5bed + displayName: DNS events related to mining pools + status: disabled + queryCondition: + queryText: |- + DnsEvents + | where Name contains "." + | where Name has_any ("monerohash.com", "do-dear.com", "xmrminerpro.com", "secumine.net", "xmrpool.com", "minexmr.org", "hashanywhere.com", + "xmrget.com", "mininglottery.eu", "minergate.com", "moriaxmr.com", "multipooler.com", "moneropools.com", "xmrpool.eu", "coolmining.club", + "supportxmr.com", "minexmr.com", "hashvault.pro", "xmrpool.net", "crypto-pool.fr", "xmr.pt", "miner.rocks", "walpool.com", "herominers.com", + "gntl.co.uk", "semipool.com", "coinfoundry.org", "cryptoknight.cc", "fairhash.org", "baikalmine.com", "tubepool.xyz", "fairpool.xyz", "asiapool.io", + "coinpoolit.webhop.me", "nanopool.org", "moneropool.com", "miner.center", "prohash.net", "poolto.be", "cryptoescrow.eu", "monerominers.net", "cryptonotepool.org", + "extrmepool.org", "webcoin.me", "kippo.eu", "hashinvest.ws", "monero.farm", "supportxmr.com", "xmrpool.eu", "linux-repository-updates.com", "1gh.com", + "dwarfpool.com", "hash-to-coins.com", "hashvault.pro", "pool-proxy.com", "hashfor.cash", "fairpool.cloud", "litecoinpool.org", "mineshaft.ml", "abcxyz.stream", + "moneropool.ru", "cryptonotepool.org.uk", "extremepool.org", "extremehash.com", "hashinvest.net", "unipool.pro", "crypto-pools.org", "monero.net", + "backup-pool.com", "mooo.com", "freeyy.me", "cryptonight.net", "shscrypto.net") + | extend HostName = iff(Computer has '.', substring(Computer,0,indexof(Computer,'.')),Computer) + | extend DnsDomain = iff(Computer has '.', substring(Computer,indexof(Computer,'.')+1),"") + schedule: + frequency: P1D + detectionAction: + alertTemplate: + title: DNS events related to mining pools + description: '''Identifies IP addresses that may be performing DNS lookups associated with common currency mining pools.''' + severity: low + entityMappings: + hosts: + - id: host1 + nameColumn: HostName + dnsDomainColumn: DnsDomain + ips: + - id: ip1 + addressColumn: ClientIP + tactics: + - tactic: Impact + techniques: + - technique: T1496 diff --git a/Solutions/Windows Server DNS/XDR Detections/DNS_TorProxies.yaml b/Solutions/Windows Server DNS/XDR Detections/DNS_TorProxies.yaml new file mode 100644 index 00000000000..8e2beadf255 --- /dev/null +++ b/Solutions/Windows Server DNS/XDR Detections/DNS_TorProxies.yaml @@ -0,0 +1,84 @@ +schemaVersion: 1.0.0 +version: 3.2.1 +kind: CustomDetection +resourceType: Microsoft.Security/detectionRules +apiVersion: 2026-06-01-preview +requiredDataConnectors: +- connectorId: DNS + dataTypes: + - DnsEvents +contentProvenance: + requiredWorkloads: + - workload: sentinel + dataTypes: + - DnsEvents + requiredDataConnectors: + - connectorId: DNS + dataTypes: + - DnsEvents + dependencyReviewRequired: false + source: + platform: Microsoft Sentinel + kind: AnalyticsRule + id: a83ef0f4-dace-4767-bce3-ebd32599d2a0 + path: Analytic Rules/DNS_TorProxies.yaml + version: 1.0.3 + querySha256: 26e3426bf4d2a7d0c18772eabc1b42bfa84364aa7ab015e12ef84065f8479113 + schedule: + queryFrequency: 1d + queryPeriod: 1d + conversion: + tool: sentinel-to-xdr-migration + version: 0.1.0 + status: converted + reviewRequired: false + reviewReasons: [] + requiredWorkloads: + - sentinel + warnings: + - 'Schedule assessment: source frequency=1d, lookback=1d; target frequency=P1D, native lookback=unknown/unconfigured; + mixed, Sentinel-only, or unknown query surface; no custom lookback is configured in the payload. See https://learn.microsoft.com/en-us/defender-xdr/custom-detection-rules#lookback' + informational: + - Host.FullName `Computer` is safely represented by retained nameColumn `HostName` and dnsDomainColumn `DnsDomain`; the + query explicitly decomposes that same full name. No fullNameColumn is emitted + errors: [] + originalTactics: + - Exfiltration + originalTechniques: + - T1048 + reviewScope: + sourceDocumentSha256: c3fc78e65ba030a56b6fd0fc8f210d6d3af71d246b80ba066d81d9e808bb7d5a + targetQuerySha256: 1795f06146c569b146080766faedb7ec433a717413e7c8e49d333b06032ebd56 +properties: + id: xdr-a83ef0f4-dace-4767-bce3-ebd32599d2a0 + displayName: DNS events related to ToR proxies + status: disabled + queryCondition: + queryText: |- + DnsEvents + | where Name contains "." + | where Name has_any ("tor2web.org", "tor2web.com", "torlink.co", "onion.to", "onion.ink", "onion.cab", "onion.nu", "onion.link", + "onion.it", "onion.city", "onion.direct", "onion.top", "onion.casa", "onion.plus", "onion.rip", "onion.dog", "tor2web.fi", + "tor2web.blutmagie.de", "onion.sh", "onion.lu", "onion.pet", "t2w.pw", "tor2web.ae.org", "tor2web.io", "tor2web.xyz", "onion.lt", + "s1.tor-gateways.de", "s2.tor-gateways.de", "s3.tor-gateways.de", "s4.tor-gateways.de", "s5.tor-gateways.de", "hiddenservice.net") + | extend HostName = iff(Computer has '.', substring(Computer,0,indexof(Computer,'.')),Computer) + | extend DnsDomain = iff(Computer has '.', substring(Computer,indexof(Computer,'.')+1),"") + schedule: + frequency: P1D + detectionAction: + alertTemplate: + title: DNS events related to ToR proxies + description: '''Identifies IP addresses performing DNS lookups associated with common ToR proxies.''' + severity: low + entityMappings: + hosts: + - id: host1 + nameColumn: HostName + dnsDomainColumn: DnsDomain + ips: + - id: ip1 + addressColumn: ClientIP + tactics: + - tactic: Exfiltration + techniques: + - technique: T1048 diff --git a/Solutions/Windows Server DNS/XDR Detections/NRT_DNS_Related_To_Mining_Pools.yaml b/Solutions/Windows Server DNS/XDR Detections/NRT_DNS_Related_To_Mining_Pools.yaml new file mode 100644 index 00000000000..1d69ed31a45 --- /dev/null +++ b/Solutions/Windows Server DNS/XDR Detections/NRT_DNS_Related_To_Mining_Pools.yaml @@ -0,0 +1,89 @@ +schemaVersion: 1.0.0 +version: 3.2.1 +kind: CustomDetection +resourceType: Microsoft.Security/detectionRules +apiVersion: 2026-06-01-preview +requiredDataConnectors: +- connectorId: DNS + dataTypes: + - DnsEvents +contentProvenance: + requiredWorkloads: + - workload: sentinel + dataTypes: + - DnsEvents + requiredDataConnectors: + - connectorId: DNS + dataTypes: + - DnsEvents + dependencyReviewRequired: false + source: + platform: Microsoft Sentinel + kind: AnalyticsRule + id: d5b32cd4-2328-43da-ab47-cd289c1f5efc + path: Analytic Rules/NRT_DNS_Related_To_Mining_Pools.yaml + version: 1.0.2 + querySha256: 89963454c2b89b7c539c86e7185dfc3d835314ed6afaf74ec985f7812328bb09 + schedule: + queryFrequency: '' + queryPeriod: '' + conversion: + tool: sentinel-to-xdr-migration + version: 0.1.0 + status: converted + reviewRequired: false + reviewReasons: [] + requiredWorkloads: + - sentinel + warnings: + - 'Schedule assessment: source frequency=unknown, lookback=unknown; target frequency=PT5M, native lookback=unknown/unconfigured; + source NRT timing is not preserved by the emitted scheduled frequency. See https://learn.microsoft.com/en-us/defender-xdr/custom-detection-rules#lookback' + informational: + - Host.FullName `Computer` is safely represented by retained nameColumn `HostName` and dnsDomainColumn `DnsDomain`; the + query explicitly decomposes that same full name. No fullNameColumn is emitted + errors: [] + originalTactics: + - Impact + originalTechniques: + - T1496 + reviewScope: + sourceDocumentSha256: d94b658ee4c0177fd98010233135dbae895b03da9223daec419317ce1c3a6030 + targetQuerySha256: 8ddd0a6aab7b19b0b1348888677546d86e89fcf9d34144d8e5155707664afe96 +properties: + id: xdr-d5b32cd4-2328-43da-ab47-cd289c1f5efc + displayName: NRT DNS events related to mining pools + status: disabled + queryCondition: + queryText: |- + DnsEvents + | where Name contains "." + | where Name has_any ("monerohash.com", "do-dear.com", "xmrminerpro.com", "secumine.net", "xmrpool.com", "minexmr.org", "hashanywhere.com", + "xmrget.com", "mininglottery.eu", "minergate.com", "moriaxmr.com", "multipooler.com", "moneropools.com", "xmrpool.eu", "coolmining.club", + "supportxmr.com", "minexmr.com", "hashvault.pro", "xmrpool.net", "crypto-pool.fr", "xmr.pt", "miner.rocks", "walpool.com", "herominers.com", + "gntl.co.uk", "semipool.com", "coinfoundry.org", "cryptoknight.cc", "fairhash.org", "baikalmine.com", "tubepool.xyz", "fairpool.xyz", "asiapool.io", + "coinpoolit.webhop.me", "nanopool.org", "moneropool.com", "miner.center", "prohash.net", "poolto.be", "cryptoescrow.eu", "monerominers.net", "cryptonotepool.org", + "extrmepool.org", "webcoin.me", "kippo.eu", "hashinvest.ws", "monero.farm", "supportxmr.com", "xmrpool.eu", "linux-repository-updates.com", "1gh.com", + "dwarfpool.com", "hash-to-coins.com", "hashvault.pro", "pool-proxy.com", "hashfor.cash", "fairpool.cloud", "litecoinpool.org", "mineshaft.ml", "abcxyz.stream", + "moneropool.ru", "cryptonotepool.org.uk", "extremepool.org", "extremehash.com", "hashinvest.net", "unipool.pro", "crypto-pools.org", "monero.net", + "backup-pool.com", "mooo.com", "freeyy.me", "cryptonight.net", "shscrypto.net") + | extend HostName = iff(Computer has '.', substring(Computer,0,indexof(Computer,'.')),Computer) + | extend DnsDomain = iff(Computer has '.', substring(Computer,indexof(Computer,'.')+1),"") + schedule: + frequency: PT5M + detectionAction: + alertTemplate: + title: NRT DNS events related to mining pools + description: '''Identifies IP addresses that may be performing DNS lookups associated with common currency mining pools.''' + severity: low + entityMappings: + hosts: + - id: host1 + nameColumn: HostName + dnsDomainColumn: DnsDomain + ips: + - id: ip1 + addressColumn: ClientIP + tactics: + - tactic: Impact + techniques: + - technique: T1496