Potential Operation Triangulation DNS C2 Beaconing to Known Domains

title: Potential Operation Triangulation DNS C2 Beaconing to Known Domains
id: d900901b-59d6-473e-aaa7-7c5e5d4783c1
related:
  - id: aa03c712-75c6-438b-8d42-de88f2427e09
    type: similar
  - id: 7fc30d63-728d-48d9-ad6f-14d14f4accf7
    type: derived
status: test
description: This rule flags DNS queries for a fixed set of domains associated with potential Operation Triangulation command-and-control activity. Attackers can use repeated DNS lookups to beacon and maintain reachability while blending into normal DNS traffic. The detection relies on DNS query telemetry matching the listed domain names.
references:
  - https://securelist.com/operation-triangulation/109842/
  - https://www-fsb-ru.translate.goog/fsb/press/message/single.htm!id=10439739@fsbMessage.html?_x_tr_sch=http&_x_tr_sl=ru&_x_tr_tl=en&_x_tr_hl=de&_x_tr_pto=wapp
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/TA/EquationGroup/net_dns_apt_equation_group_triangulation_c2_coms.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2023-06-01
tags:
  - attack.command-and-control
  - attack.g0020
  - detection.emerging-threats
logsource:
  category: dns
detection:
  selection:
    query:
      - addatamarket.net
      - ans7tv.net
      - anstv.net
      - backuprabbit.com
      - businessvideonews.com
      - cloudsponcer.com
      - datamarketplace.net
      - growthtransport.com
      - mobilegamerstats.com
      - snoweeanalytics.com
      - tagclick-cdn.com
      - topographyupdates.com
      - unlimitedteacup.com
      - virtuallaughing.com
      - web-trackers.com
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1