Windows DNS Server Analytics: Detects GALLIUM-linked suspicious QNAMEs (EventID 257)

title: "Windows DNS Server Analytics: Detects GALLIUM-linked suspicious QNAMEs (EventID 257)"
id: f6a38b05-f078-4447-8f23-8fe5a1f9e814
related:
  - id: 440a56bf-7873-4439-940a-1c8a671073c2
    type: derived
  - id: 3db10f25-2527-4b79-8d4b-471eb900ee29
    type: derived
status: test
description: This rule flags Windows DNS Server Analytical events (EventID 257) where the queried QNAME matches specific suspicious domains and subdomains associated with GALLIUM indicators from December 2019. Such DNS query activity can reflect command-and-control or credential-access related infrastructure reaching out over name resolution. It relies on Windows DNS Server Analytical telemetry containing the event ID and the full QNAME string.
references:
  - https://www.microsoft.com/security/blog/2019/12/12/gallium-targeting-global-telecom/
  - https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/dn800669(v=ws.11)
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2020/TA/GALLIUM/win_dns_analytic_apt_gallium.yml
author: Tim Burrell, Huntrule Team
date: 2020-02-07
modified: 2023-01-02
tags:
  - attack.credential-access
  - attack.command-and-control
  - attack.t1071
  - detection.emerging-threats
logsource:
  product: windows
  service: dns-server-analytic
  definition: "Requirements: Microsoft-Windows-DNS-Server/Analytical ({EB79061A-A566-4698-9119-3ED2807060E7}) Event Log must be collected in order to receive the events."
detection:
  selection:
    EventID: 257
    QNAME:
      - asyspy256.ddns.net
      - hotkillmail9sddcc.ddns.net
      - rosaf112.ddns.net
      - cvdfhjh1231.myftp.biz
      - sz2016rose.ddns.net
      - dffwescwer4325.myftp.biz
      - cvdfhjh1231.ddns.net
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1