Managed Sentinel – Alert 024

Alert IDMS-A024
Alert NameDNS Domain anomalous lookup increase
DescriptionChecking for a threefold increase or more of Domain lookup per ClientIP for today based on daily average for the previous week. This can potentially identify excessive traffic to a given location that could be indicative of data transfer out of your network to a group of systems on the same second level domain. For example, if one client is sending requests for test1.badguy.com and another client is sending requests for test2.badguy.com, you may not see a high enough count to be interesting. However, a combination of the requests to badguy.com could have a high enough count to be interesting.
Source: Github - Microsoft
Severity LevelMedium
Threat IndicatorData Theft
MITRE ATT&CK TacticsCommand and Control
Exfiltration
Log sourcesDNS Logs
False PositivesUnknown
Recommendations This is only Name lookups, so it would be recommended to review the Firewall\Webproxy logs in relation to the ClientIP making the interesting requests.