Suspicious DNS Queries Containing Base64 Delimiters (==.)

Alerts on DNS queries containing the base64 delimiter pattern '==.' consistent with encoded data in DNS.

FreeUnreviewedSigmamediumv1

suspicious-dns-queries-containing-base64-delimiters-4153a907

title: Suspicious DNS Queries Containing Base64 Delimiters (==.)
id: 52382811-fb74-4092-8312-e48ad04971ed
status: test
description: This rule flags DNS queries whose query string contains the base64 delimiter pattern '==.'. Attackers often use DNS as a covert channel to exfiltrate data or communicate with command-and-control by embedding encoded content in queries. Detection relies on DNS telemetry with the full query text available for substring matching against the specified pattern.
references:
  - https://github.com/krmaxwell/dns-exfiltration
  - https://github.com/SigmaHQ/sigma/blob/master/rules/network/dns/net_dns_susp_b64_queries.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2018-05-10
modified: 2022-10-09
tags:
  - attack.exfiltration
  - attack.t1048.003
  - attack.command-and-control
  - attack.t1071.004
logsource:
  category: dns
detection:
  selection:
    query|contains: ==.
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 4153a907-2451-4e4f-a578-c52bb6881432
    type: derived

What it detects

This rule flags DNS queries whose query string contains the base64 delimiter pattern '==.'. Attackers often use DNS as a covert channel to exfiltrate data or communicate with command-and-control by embedding encoded content in queries. Detection relies on DNS telemetry with the full query text available for substring matching against the specified pattern.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.