DNS Query Length With High Standard Deviation

The following analytic identifies DNS queries with unusually large lengths by computing the standard deviation of query lengths and filtering those exceeding two times the standard deviation. It leverages DNS query data from the Network_Resolution data model, focusing on the length of the domain names being resolved. This activity is significant as unusually long DNS queries can indicate data exfiltration or command-and-control communication attempts. If confirmed malicious, this activity could allow attackers to stealthily transfer data or maintain persistent communication channels within the network.

ATT&CK coverage

Exfiltration

T1048Exfiltration Over Alternative Protocol
- T1048.003Exfiltration Over Unencrypted Non-C2 Protocol 22 detections cover this technique

Detection requirements

Log source category: sysmon_eventid_22

Detection logic

Published to signed-in readers

The query as its source wrote it, its canonical form, and the content hash that pins this exact revision.

Sign in to read it Create an account

Detection catalogue

ATT&CK coverage

Detection requirements

Detection logic