anomalous-dns

https://github.com/jbaggs/anomalous-dns
3 33 6 0 Last Push 5/18/24, 6:24 AM

Anomalous-DNS

A set of zeek scripts providing a module for tracking and correlating abnormal DNS behavior. Detection of tunneling and C&C through connection duration and volume, request and answer size, DNS request type, and unique queries per domain. Statistical classification of fast flux networks based on A records and ASNs.

Requirements ____________

domain-tld: https://github.com/sethhall/domain-tld (automatically installed with package)

Installation ____________

zkg install jbaggs/anomalous-dns

Documentation _____________

Current documentation consists of inline comments.

Package Version :

Description :

A module for tracking and correlating abnormal DNS behavior. Detection of tunneling and C&C through connection duration and volume, request and answer size, DNS request type, and unique queries per domain. Statistical classification of fast flux networks based on A records and ASNs.

Script Dir :

scripts

Config Files :

domain-whitelist.zeek, fast_flux-whitelist.zeek, recursive-whitelist.zeek, scripts/domain-whitelist.zeek, scripts/fast_flux-whitelist.zeek, scripts/recursive-whitelist.zeek

Depends :

https://github.com/sethhall/domain-tld >=1.2.2
zeek >=3.0.0

Tags :

zeek scripting, domain, dns, notices

Description :

A module for tracking and correlating abnormal DNS behavior. Detection of tunneling and C&C through connection duration and volume, request and answer size, DNS request type, and unique queries per domain. Statistical classification of fast flux networks based on A records and ASNs.

Script Dir :

scripts

Config Files :

domain-whitelist.zeek, fast_flux-whitelist.zeek, recursive-whitelist.zeek, scripts/__load__.zeek, scripts/domain-whitelist.zeek, scripts/fast_flux-whitelist.zeek, scripts/recursive-whitelist.zeek

Depends :

https://github.com/sethhall/domain-tld >=1.2.2
zeek >=3.0.0

Tags :

zeek scripting, domain, dns, notices

Description :

A module for tracking and correlating abnormal DNS behavior. Detection of tunneling and C&C through connection duration and volume, request and answer size, DNS request type, and unique queries per domain. Statistical classification of fast flux networks based on A records and ASNs.

Script Dir :

scripts

Config Files :

domain-whitelist.zeek, fast_flux-whitelist.zeek, recursive-whitelist.zeek, scripts/__load__.zeek, scripts/domain-whitelist.zeek, scripts/fast_flux-whitelist.zeek, scripts/recursive-whitelist.zeek

Depends :

https://github.com/sethhall/domain-tld >=1.2.2
zeek >=3.0.0

Tags :

zeek scripting, domain, dns, notices

Description :

A module for tracking and correlating abnormal DNS behavior. Detection of tunneling and C&C through connection duration and volume, request and answer size, DNS request type, and unique queries per domain. Statistical classification of fast flux networks based on A records and ASNs.

Script Dir :

scripts

Config Files :

domain-whitelist.zeek, fast_flux-whitelist.zeek, recursive-whitelist.zeek, scripts/__load__.zeek, scripts/domain-whitelist.zeek, scripts/fast_flux-whitelist.zeek, scripts/recursive-whitelist.zeek

Depends :

https://github.com/sethhall/domain-tld >=1.2.2
zeek >=5.0.8

Tags :

zeek scripting, domain, dns, notices

Description :

A module for tracking and correlating abnormal DNS behavior. Detection of tunneling and C&C through connection duration and volume, request and answer size, DNS request type, and unique queries per domain.

Tags :

domain, dns, notices, bro scripting

Description :

A module for tracking and correlating abnormal DNS behavior. Detection of tunneling and C&C through connection duration and volume, request and answer size, DNS request type, and unique queries per domain.

Tags :

domain, dns, notices, bro scripting

Description :

A module for tracking and correlating abnormal DNS behavior. Detection of tunneling and C&C through connection duration and volume, request and answer size, DNS request type, and unique queries per domain.

Tags :

domain, dns, notices, bro scripting

Description :

A module for tracking and correlating abnormal DNS behavior. Detection of tunneling and C&C through connection duration and volume, request and answer size, DNS request type, and unique queries per domain.

Depends :

https://github.com/sethhall/domain-tld *
zeek >=3.0.0

Tags :

domain, dns, notices, bro scripting

Description :

A module for tracking and correlating abnormal DNS behavior. Detection of tunneling and C&C through connection duration and volume, request and answer size, DNS request type, and unique queries per domain.

Depends :

https://github.com/sethhall/domain-tld *
zeek >=3.0.0

Tags :

domain, dns, notices, bro scripting

Description :

A module for tracking and correlating abnormal DNS behavior. Detection of tunneling and C&C through connection duration and volume, request and answer size, DNS request type, and unique queries per domain.

Depends :

https://github.com/sethhall/domain-tld *
zeek >=3.0.0

Tags :

zeek scripting, domain, dns, notices

Description :

A module for tracking and correlating abnormal DNS behavior. Detection of tunneling and C&C through connection duration and volume, request and answer size, DNS request type, and unique queries per domain. Statistical clasification of fast flux networks based on A records and ASNs.

Depends :

https://github.com/sethhall/domain-tld *
zeek >=3.0.0

Tags :

zeek scripting, domain, dns, notices