sigmahighHunting

Suspicious Named Error

Detects suspicious DNS error messages that indicate a fatal or suspicious error that could be caused by exploiting attempts

MITRE ATT&CK

T1190

initial-access

Detection Query

keywords:
  - " dropping source port zero packet from "
  - " denied AXFR from "
  - " exiting (due to fatal error)"
condition: keywords

Author

Florian Roth (Nextron Systems)

Created

2018-02-20

Data Sources

linuxsyslog

Platforms

linux

References

https://github.com/ossec/ossec-hids/blob/1ecffb1b884607cb12e619f9ab3c04f530801083/etc/rules/named_rules.xml

Tags

attack.initial-accessattack.t1190

Raw Content

title: Suspicious Named Error
id: c8e35e96-19ce-4f16-aeb6-fd5588dc5365
status: test
description: Detects suspicious DNS error messages that indicate a fatal or suspicious error that could be caused by exploiting attempts
references:
    - https://github.com/ossec/ossec-hids/blob/1ecffb1b884607cb12e619f9ab3c04f530801083/etc/rules/named_rules.xml
author: Florian Roth (Nextron Systems)
date: 2018-02-20
modified: 2022-10-05
tags:
    - attack.initial-access
    - attack.t1190
logsource:
    product: linux
    service: syslog
detection:
    keywords:
        - ' dropping source port zero packet from '
        - ' denied AXFR from '
        - ' exiting (due to fatal error)'
    condition: keywords
falsepositives:
    - Unknown
level: high