search

SwiftOnSecurity / sysmon-config

Sysmon configuration file template with default high-quality event tracing
4.73k stars 1.69k forks source link

Changed the bypassable DNS hostname checks #107

Open MaxNad opened 4 years ago

MaxNad commented 4 years ago

I modified some of the rules for Event id 3 (Network connection initiated) and Event id 22 (DNS query) to remove potential bypasses.

Multiple check were done on incomplete hostnames like <DestinationHostname condition="end with">amazontrust.com</DestinationHostname>. If somebody registers notamazontrust.com, it would still match the rule and would not show up in the collected events. I split those rules in two different matches to match either amazontrust.com or its subdomains :

<QueryName condition="is">amazontrust.com</QueryName>
<QueryName condition="end with">.amazontrust.com</QueryName>