AlertsForDNS.json

{
    "name": "Alerts for DNS",
    "versions": {
        "attack": "8",
        "navigator": "4.2",
        "layer": "4.2"
    },
    "domain": "enterprise-attack",
    "description": "Azure Defender for DNS provides an additional layer of protection for your cloud resources by continuously monitoring all DNS queries from your Azure resources and running advanced security analytics to alert you about suspicious activity\n",
    "filters": {
        "platforms": [
            "Linux",
            "macOS",
            "Windows",
            "Office 365",
            "Azure AD",
            "AWS",
            "GCP",
            "Azure",
            "SaaS",
            "PRE",
            "Network"
        ]
    },
    "sorting": 0,
    "layout": {
        "layout": "side",
        "showID": false,
        "showName": true,
        "showAggregateScores": false,
        "countUnscored": false,
        "aggregateFunction": "average"
    },
    "hideDisabled": false,
    "techniques": [
        {
            "techniqueID": "T1568",
            "enabled": true,
            "showSubtechniques": false,
            "metadata": [
                {
                    "name": "category",
                    "value": "Detect"
                },
                {
                    "name": "value",
                    "value": "Partial"
                },
                {
                    "name": "comment",
                    "value": "Can identify \"random\" DNS occurences which can be associated with domain generation algorithm or Fast Flux sub-techniques.  Partial for coverage and accuracy (potential for false positive/benign).\n"
                }
            ],
            "color": "#5F9F9F",
            "score_num": 50,
            "score_display": "Partial",
            "category": "Detect"
        },
        {
            "techniqueID": "T1568.001",
            "enabled": true,
            "showSubtechniques": false,
            "metadata": [
                {
                    "name": "category",
                    "value": "Detect"
                },
                {
                    "name": "value",
                    "value": "Partial"
                },
                {
                    "name": "comment",
                    "value": "Detects \"random\" DNS name occurences, potentially indicative of Fast Flux or DGA. Potential false positives from benign \"random\" DNS names."
                }
            ],
            "color": "#5F9F9F",
            "score_num": 50,
            "score_display": "Partial",
            "category": "Detect"
        },
        {
            "techniqueID": "T1568.002",
            "enabled": true,
            "showSubtechniques": false,
            "metadata": [
                {
                    "name": "category",
                    "value": "Detect"
                },
                {
                    "name": "value",
                    "value": "Partial"
                },
                {
                    "name": "comment",
                    "value": "Detects \"random\" DNS name occurences, potentially indicative of Fast Flux or DGA. Potential false positives from benign \"random\" DNS names."
                }
            ],
            "color": "#5F9F9F",
            "score_num": 50,
            "score_display": "Partial",
            "category": "Detect"
        },
        {
            "techniqueID": "T1071",
            "enabled": true,
            "showSubtechniques": false,
            "metadata": [
                {
                    "name": "category",
                    "value": "Detect"
                },
                {
                    "name": "value",
                    "value": "Minimal"
                },
                {
                    "name": "comment",
                    "value": "Can detect potential DNS protocol misuse/anomalies. Technique coverage is restricted to DNS and therefore results in a Minimal score."
                }
            ],
            "color": "#AEEEEE",
            "score_num": 10,
            "score_display": "Minimal",
            "category": "Detect"
        },
        {
            "techniqueID": "T1071.004",
            "enabled": true,
            "showSubtechniques": false,
            "metadata": [
                {
                    "name": "category",
                    "value": "Detect"
                },
                {
                    "name": "value",
                    "value": "Significant"
                },
                {
                    "name": "comment",
                    "value": "Can alert on anomalies and misuse of the DNS protocol."
                }
            ],
            "color": "#00FFFF",
            "score_num": 100,
            "score_display": "Significant",
            "category": "Detect"
        },
        {
            "techniqueID": "T1572",
            "enabled": true,
            "showSubtechniques": false,
            "metadata": [
                {
                    "name": "category",
                    "value": "Detect"
                },
                {
                    "name": "value",
                    "value": "Minimal"
                },
                {
                    "name": "comment",
                    "value": "Can identify protocol misuse/anomalies in DNS.  Because this detection is specific to DNS, its coverage score is Minimal resulting in an overall Minimal score."
                }
            ],
            "color": "#AEEEEE",
            "score_num": 10,
            "score_display": "Minimal",
            "category": "Detect"
        },
        {
            "techniqueID": "T1090",
            "enabled": true,
            "showSubtechniques": false,
            "metadata": [
                {
                    "name": "category",
                    "value": "Detect"
                },
                {
                    "name": "value",
                    "value": "Minimal"
                },
                {
                    "name": "comment",
                    "value": "Can detect DNS activity to anonymity networks e.g. TOR.  Because this detection is specific to DNS, its coverage score is Minimal resulting in an overall Minimal score."
                }
            ],
            "color": "#AEEEEE",
            "score_num": 10,
            "score_display": "Minimal",
            "category": "Detect"
        },
        {
            "techniqueID": "T1048",
            "enabled": true,
            "showSubtechniques": false,
            "metadata": [
                {
                    "name": "category",
                    "value": "Detect"
                },
                {
                    "name": "value",
                    "value": "Minimal"
                },
                {
                    "name": "comment",
                    "value": "Can detect anomalous use of DNS.  Because this detection is specific to DNS, its coverage score is Minimal resulting in an overall Minimal score."
                }
            ],
            "color": "#AEEEEE",
            "score_num": 10,
            "score_display": "Minimal",
            "category": "Detect"
        }
    ],
    "gradient": {
        "colors": [
            "#ff6666",
            "#ffe766",
            "#8ec843"
        ],
        "minValue": 0,
        "maxValue": 100
    },
    "legendItems": [
        {
            "label": "Protect - Minimal",
            "color": "#9CBA7F"
        },
        {
            "label": "Protect - Partial",
            "color": "#659D32"
        },
        {
            "label": "Protect - Significant",
            "color": "#7FFF00"
        },
        {
            "label": "Detect - Minimal",
            "color": "#AEEEEE"
        },
        {
            "label": "Detect - Partial",
            "color": "#5F9F9F"
        },
        {
            "label": "Detect - Significant",
            "color": "#00FFFF"
        },
        {
            "label": "Respond - Minimal",
            "color": "#ff6b6b"
        },
        {
            "label": "Respond - Partial",
            "color": "#ff0505"
        },
        {
            "label": "Respond - Significant",
            "color": "#b80000"
        },
        {
            "label": "Mixed - Minimal",
            "color": "#bf6bff"
        },
        {
            "label": "Mixed - Partial",
            "color": "#9305ff"
        },
        {
            "label": "Mixed - Significant",
            "color": "#5c00a3"
        }
    ],
    "metadata": [],
    "showTacticRowBackground": false,
    "tacticRowBackground": "#dddddd",
    "selectTechniquesAcrossTactics": true,
    "selectSubtechniquesWithParent": false
}