Zeek DNS: NKN seed domain lookups for potential C2 over .nkn.org

Alerts on Zeek DNS queries containing "seed" and ending with .nkn.org, a pattern consistent with NKN network activity.

FreeUnreviewedSigmalowv1

zeek-dns-nkn-seed-domain-lookups-for-potential-c2-over-nkn-org-fa7703d6

title: "Zeek DNS: NKN seed domain lookups for potential C2 over .nkn.org"
id: c143d1ad-a2de-4b8c-a3b5-9d7ed707934b
status: test
description: This rule flags Zeek DNS events where the queried name contains both the substring "seed" and the suffix ".nkn.org". Such naming patterns can indicate network bootstrapping activity associated with NKN-based communications, which may be abused as a command-and-control channel. The detection relies on DNS query contents observed by Zeek for the DNS service.
references:
  - https://github.com/nknorg/nkn-sdk-go
  - https://unit42.paloaltonetworks.com/manageengine-godzilla-nglite-kdcsponge/
  - https://github.com/Maka8ka/NGLite
  - https://github.com/SigmaHQ/sigma/blob/master/rules/network/zeek/zeek_dns_nkn.yml
author: Michael Portera (@mportatoes), Huntrule Team
date: 2022-04-21
tags:
  - attack.command-and-control
logsource:
  product: zeek
  service: dns
detection:
  selection:
    query|contains|all:
      - seed
      - .nkn.org
  condition: selection
falsepositives:
  - Unknown
level: low
license: DRL-1.1
related:
  - id: fa7703d6-0ee8-4949-889c-48c84bc15b6f
    type: derived

What it detects

This rule flags Zeek DNS events where the queried name contains both the substring "seed" and the suffix ".nkn.org". Such naming patterns can indicate network bootstrapping activity associated with NKN-based communications, which may be abused as a command-and-control channel. The detection relies on DNS query contents observed by Zeek for the DNS service.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.