Sunturai
Back to results
MediumMicrosoft Sentinel analyticsThreat hunting

Datazag - retro-hunt historical DNS against impersonation indicators

Matches Datazag impersonation indicators against historical ASIM-normalized DNS to surface domains resolved inside the estate before the feed was connected. Adjust dns_lookback to your DNS retention. Requires ASIM…

Description

Matches Datazag impersonation indicators against historical ASIM-normalized DNS to surface domains resolved inside the estate before the feed was connected. Adjust dns_lookback to your DNS retention. Requires ASIM DNS parsers.

Detection logic

Detection requirements

Platform
ESXiIdentity ProviderLinuxmacOSNetwork DevicesOffice SuiteSaaSWindows

The rule states no platform. This is derived from the 2 ATT&CK techniques it maps to.

Log source product
threatintelligencetaxii
Log source service
threatintelindicators

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice