
title: Possible DNS Rebinding
author: Ilyas Ochkov, oscd.community
date: 2019/10/25
description: Detects several different DNS-answers by one domain with IPs from internal
  and external networks. Normally, DNS-answer contain TTL >100. (DNS-record will saved
  in host cache for a while TTL).
detection:
  SELECTION_1:
    EventID: 22
  SELECTION_2:
    QueryName: '*'
  SELECTION_3:
    QueryStatus: '0'
  SELECTION_4:
    QueryResults:
    - (::ffff:)?10.*
    - (::ffff:)?192.168.*
    - (::ffff:)?172.16.*
    - (::ffff:)?172.17.*
    - (::ffff:)?172.18.*
    - (::ffff:)?172.19.*
    - (::ffff:)?172.20.*
    - (::ffff:)?172.21.*
    - (::ffff:)?172.22.*
    - (::ffff:)?172.23.*
    - (::ffff:)?172.24.*
    - (::ffff:)?172.25.*
    - (::ffff:)?172.26.*
    - (::ffff:)?172.27.*
    - (::ffff:)?172.28.*
    - (::ffff:)?172.29.*
    - (::ffff:)?172.30.*
    - (::ffff:)?172.31.*
    - (::ffff:)?127.*
  SELECTION_5:
    QueryName: '*'
  SELECTION_6:
    QueryStatus: '0'
  SELECTION_7:
    QueryResults:
    - (::ffff:)?10.*
    - (::ffff:)?192.168.*
    - (::ffff:)?172.16.*
    - (::ffff:)?172.17.*
    - (::ffff:)?172.18.*
    - (::ffff:)?172.19.*
    - (::ffff:)?172.20.*
    - (::ffff:)?172.21.*
    - (::ffff:)?172.22.*
    - (::ffff:)?172.23.*
    - (::ffff:)?172.24.*
    - (::ffff:)?172.25.*
    - (::ffff:)?172.26.*
    - (::ffff:)?172.27.*
    - (::ffff:)?172.28.*
    - (::ffff:)?172.29.*
    - (::ffff:)?172.30.*
    - (::ffff:)?172.31.*
    - (::ffff:)?127.*
  condition: (SELECTION_1 and SELECTION_2 and SELECTION_3 and SELECTION_4 and (SELECTION_5
    and SELECTION_6) and  not (SELECTION_7)) | count(QueryName) by ComputerName >
    3
id: eb07e747-2552-44cd-af36-b659ae0958e4
level: medium
logsource:
  category: dns_query
  product: windows
modified: 2020/08/28
references:
- https://medium.com/@brannondorsey/attacking-private-networks-from-the-internet-with-dns-rebinding-ea7098a2d325
status: experimental
tags:
- attack.initial_access
- attack.t1189
ruletype: SIGMA
