From abdf43abdd076d5a41a75e6f562221d2509cc427 Mon Sep 17 00:00:00 2001 From: MehrabBakhtar Date: Sat, 10 Oct 2026 23:58:15 +0330 Subject: [PATCH 1/3] Create detect_dns_ptr_based_host_discovery.yml --- .../detect_dns_ptr_based_host_discovery.yml | 32 +++++++++++++++++++ 1 file changed, 32 insertions(+) create mode 100644 detections/detect_dns_ptr_based_host_discovery.yml diff --git a/detections/detect_dns_ptr_based_host_discovery.yml b/detections/detect_dns_ptr_based_host_discovery.yml new file mode 100644 index 0000000000..b49e73f514 --- /dev/null +++ b/detections/detect_dns_ptr_based_host_discovery.yml @@ -0,0 +1,32 @@ +name: DNS PTR-Based Host Discovery +id: ae8ee2ad-1f54-4e8a-820e-eef32684e933 +version: 1 +creation_date: '2026-10-10' +modification_date: '2026-10-10' +author: Mehrab Bakhtar +status: experimental +type: Anomaly +description: This detection identifies source systems generating a high number of unique DNS PTR queries, which may indicate host discovery or reverse DNS reconnaissance. This activity may be associated with tools such as Nmap when reverse DNS lookups are performed for discovered or scanned hosts. +data_source: + - DNS +search: |- + | tstats `security_content_summariesonly` min(_time) as firsttime max(_time) as lasttime dc(DNS.query) AS unique_queries FROM datamodel=Network_Resolution WHERE DNS.record_type="PTR" BY DNS.src + | `drop_dm_object_name("DNS")` + | search unique_queries >= 80 + | sort - unique_queries + | `security_content_ctime(firsttime)` + | `security_content_ctime(lasttime)` + | `detect_dns_ptr_based_host_discovery_filter` +how_to_implement: This detection requires DNS events mapped to the Network Resolution data model, including DNS.query, DNS.record_type, and DNS.src. Ensure the data model is populated and appropriately accelerated for summaries-only searches. Tune the threshold according to normal DNS activity. A high volume of unique PTR queries may indicate reverse DNS-based host discovery, including activity associated with Nmap when reverse lookups are performed. Behavior depends on scan options, DNS configuration, and available reverse DNS records. +known_false_positives: Legitimate asset discovery tools, vulnerability scanners, network monitoring systems, administrative scripts, and authorized Nmap scans may generate large numbers of PTR queries. Validate the source system and its expected behavior before determining whether the activity is suspicious. +references: + - https://attack.mitre.org/techniques/T1018/ +mitre_attack_id: + - T1018 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: network +security_domain: network +tests: [] From 1127d31742f4dd225c10d13dc1574adadfbbb19b Mon Sep 17 00:00:00 2001 From: loserprogrammerguy Date: Sun, 11 Oct 2026 00:39:39 +0330 Subject: [PATCH 2/3] Add DNS PTR-based host discovery detection --- .../dns_ptr_based_host_discovery.yml} | 25 +++++++++++++++---- 1 file changed, 20 insertions(+), 5 deletions(-) rename detections/{detect_dns_ptr_based_host_discovery.yml => network/dns_ptr_based_host_discovery.yml} (78%) diff --git a/detections/detect_dns_ptr_based_host_discovery.yml b/detections/network/dns_ptr_based_host_discovery.yml similarity index 78% rename from detections/detect_dns_ptr_based_host_discovery.yml rename to detections/network/dns_ptr_based_host_discovery.yml index b49e73f514..08907cdbfd 100644 --- a/detections/detect_dns_ptr_based_host_discovery.yml +++ b/detections/network/dns_ptr_based_host_discovery.yml @@ -1,4 +1,4 @@ -name: DNS PTR-Based Host Discovery +name: DNS PTR-Based Host Discovery id: ae8ee2ad-1f54-4e8a-820e-eef32684e933 version: 1 creation_date: '2026-10-10' @@ -7,8 +7,7 @@ author: Mehrab Bakhtar status: experimental type: Anomaly description: This detection identifies source systems generating a high number of unique DNS PTR queries, which may indicate host discovery or reverse DNS reconnaissance. This activity may be associated with tools such as Nmap when reverse DNS lookups are performed for discovered or scanned hosts. -data_source: - - DNS +data_source: [] search: |- | tstats `security_content_summariesonly` min(_time) as firsttime max(_time) as lasttime dc(DNS.query) AS unique_queries FROM datamodel=Network_Resolution WHERE DNS.record_type="PTR" BY DNS.src | `drop_dm_object_name("DNS")` @@ -16,17 +15,33 @@ search: |- | sort - unique_queries | `security_content_ctime(firsttime)` | `security_content_ctime(lasttime)` - | `detect_dns_ptr_based_host_discovery_filter` + | `dns_ptr_based_host_discovery_filter` how_to_implement: This detection requires DNS events mapped to the Network Resolution data model, including DNS.query, DNS.record_type, and DNS.src. Ensure the data model is populated and appropriately accelerated for summaries-only searches. Tune the threshold according to normal DNS activity. A high volume of unique PTR queries may indicate reverse DNS-based host discovery, including activity associated with Nmap when reverse lookups are performed. Behavior depends on scan options, DNS configuration, and available reverse DNS records. known_false_positives: Legitimate asset discovery tools, vulnerability scanners, network monitoring systems, administrative scripts, and authorized Nmap scans may generate large numbers of PTR queries. Validate the source system and its expected behavior before determining whether the activity is suspicious. +intermediate_findings: + entities: + - field: src + type: system + score: 20 + message: DNS PTR-based host discovery from $src$ references: - https://attack.mitre.org/techniques/T1018/ mitre_attack_id: - T1018 +analytic_story: + - Network Discovery +asset_type: Endpoint product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud category: network security_domain: network -tests: [] +tests: + - name: Manual Validation + description: Manually validate that a source generating at least 80 unique DNS PTR queries is returned by the detection. + test_type: experimental + attack_data: [] + + + From 9b11a1917450046c7e1e127b90f7e45f04f88001 Mon Sep 17 00:00:00 2001 From: MehrabBakhtar Date: Mon, 12 Oct 2026 03:04:02 -0700 Subject: [PATCH 3/3] Apply suggestion from @nasbench Co-authored-by: Nasreddine Bencherchali --- detections/network/dns_ptr_based_host_discovery.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/network/dns_ptr_based_host_discovery.yml b/detections/network/dns_ptr_based_host_discovery.yml index 08907cdbfd..887f0026e4 100644 --- a/detections/network/dns_ptr_based_host_discovery.yml +++ b/detections/network/dns_ptr_based_host_discovery.yml @@ -16,7 +16,7 @@ search: |- | `security_content_ctime(firsttime)` | `security_content_ctime(lasttime)` | `dns_ptr_based_host_discovery_filter` -how_to_implement: This detection requires DNS events mapped to the Network Resolution data model, including DNS.query, DNS.record_type, and DNS.src. Ensure the data model is populated and appropriately accelerated for summaries-only searches. Tune the threshold according to normal DNS activity. A high volume of unique PTR queries may indicate reverse DNS-based host discovery, including activity associated with Nmap when reverse lookups are performed. Behavior depends on scan options, DNS configuration, and available reverse DNS records. +how_to_implement: This detection requires DNS events mapped to the Network Resolution data model, including DNS.query, DNS.record_type, and DNS.src. Ensure the data model is populated and appropriately accelerated for summaries-only searches. Tune the threshold according to normal DNS activity. known_false_positives: Legitimate asset discovery tools, vulnerability scanners, network monitoring systems, administrative scripts, and authorized Nmap scans may generate large numbers of PTR queries. Validate the source system and its expected behavior before determining whether the activity is suspicious. intermediate_findings: entities: