huntrule

Linux syslog: Suspicious BIND named error messages (fatal or access-denied)

Alerts on Linux syslog messages with BIND named fatal or denied DNS error strings.

FreeUnreviewedSigmahighv1
title: "Linux syslog: Suspicious BIND named error messages (fatal or access-denied)"
id: a34c0ce4-6d3d-4465-981e-e5e2b710169d
status: test
description: This rule flags syslog entries containing specific BIND/named error strings that indicate fatal conditions or denied DNS actions. Such messages can occur during exploitation attempts or probing activity when an attacker triggers error paths like unauthorized zone transfers or malformed packets. The detection relies on Linux syslog text matching the configured keyword phrases.
references:
  - https://github.com/ossec/ossec-hids/blob/1ecffb1b884607cb12e619f9ab3c04f530801083/etc/rules/named_rules.xml
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/builtin/syslog/lnx_syslog_susp_named.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2018-02-20
modified: 2022-10-05
tags:
  - attack.initial-access
  - attack.t1190
logsource:
  product: linux
  service: syslog
detection:
  keywords:
    - " dropping source port zero packet from "
    - " denied AXFR from "
    - " exiting (due to fatal error)"
  condition: keywords
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: c8e35e96-19ce-4f16-aeb6-fd5588dc5365
    type: derived

What it detects

This rule flags syslog entries containing specific BIND/named error strings that indicate fatal conditions or denied DNS actions. Such messages can occur during exploitation attempts or probing activity when an attacker triggers error paths like unauthorized zone transfers or malformed packets. The detection relies on Linux syslog text matching the configured keyword phrases.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.