heroui logo

Detect suspicious DNS TXT records using pretrained model in DSDL

Splunk Security Content

View Source
Summary
The analytic rule "Detect suspicious DNS TXT records using pretrained model in DSDL" aims to identify potentially malicious DNS TXT records, which may be indicative of abnormal activities such as data exfiltration or command-and-control server communication. The detection leverages a pre-trained deep learning model applied to the Network Resolution data model in Splunk, utilizing DNS response data. It categorizes TXT records using regular expressions to identify known patterns; those records that do not match established formats are flagged as suspicious. This analytic is critical as attackers often misuse TXT records to covertly exfiltrate data or communicate instructions, leading to severe network security risks. The deployment of this model requires integration with Splunk's Data Science and Deep Learning app and involves specific setup steps to ensure proper functionality and accurate threat detection against potential DNS abuses.
Categories
  • Network
  • Endpoint
Data Sources
  • Network Traffic
ATT&CK Techniques
  • T1071
  • T1568.002
Created: 2024-11-15