Skip to content

Unbound

Overview

Unbound is a validating, recursive, and caching DNS resolver product from NLnet Labs. It is distributed free of charge in open-source form under the BSD license.

The following Sekoia.io built-in rules match the intake Unbound. This documentation is updated automatically and is based solely on the fields used by the intake which are checked against our rules. This means that some rules will be listed but might not be relevant with the intake.

SEKOIA.IO x Unbound on ATT&CK Navigator

SEKOIA.IO Intelligence Feed

Detect threats based on indicators of compromise (IOCs) collected by SEKOIA's Threat and Detection Research team.

  • Effort: elementary
Sliver DNS Beaconing

Detects suspicious DNS queries known from Sliver beaconing

  • Effort: intermediate

Event Categories

The following table lists the data source offered by this integration.

Data Source Description
DNS records unbound DNS queries

Event Samples

Find below few samples of events and how they are normalized by Sekoia.io.

{
    "message": "2019-10-08T11:29:05+02:00 hostfoo unbound[17265]: [17265:13] info: 127.0.0.1 reachms.corp.com. A IN",
    "dns": {
        "question": {
            "class": "IN",
            "name": "reachms.corp.com",
            "registered_domain": "corp.com",
            "subdomain": "reachms",
            "top_level_domain": "com",
            "type": "A"
        },
        "size_in_char": 16,
        "type": "query"
    },
    "host": {
        "name": "hostfoo"
    },
    "related": {
        "hosts": [
            "reachms.corp.com"
        ],
        "ip": [
            "127.0.0.1"
        ]
    },
    "source": {
        "address": "127.0.0.1",
        "ip": "127.0.0.1"
    }
}

{
    "message": "[3483:15] error: internal error: looping module stopped",
    "error": {
        "message": "looping module stopped",
        "type": "internal error"
    }
}

{
    "message": "[1678:6] error: failed to find an open port, drop msg",
    "error": {
        "message": "failed to find an open port, drop msg"
    }
}

{
    "message": "2019-10-08T11:29:05+02:00 hostfoo unbound[17265]: [265456:0] info: generate keytag query _ta-4f66. NULL IN",
    "host": {
        "name": "hostfoo"
    }
}

{
    "message": "2019-10-08T11:29:05+02:00 hostfoo unbound[17265]: [27060:0] info: average recursion processing time 0.007562 sec",
    "host": {
        "name": "hostfoo"
    }
}

{
    "message": "2019-10-08T11:29:04+02:00 hostfoo unbound[17265]: [17265:18] info: 192.168.1.1 1.1.1.1.in-addr.arpa. PTR IN",
    "dns": {
        "question": {
            "class": "IN",
            "name": "1.1.1.1.in-addr.arpa",
            "registered_domain": "1.in-addr.arpa",
            "subdomain": "1.1.1",
            "top_level_domain": "in-addr.arpa",
            "type": "PTR"
        },
        "size_in_char": 20,
        "type": "query"
    },
    "host": {
        "name": "hostfoo"
    },
    "related": {
        "hosts": [
            "1.1.1.1.in-addr.arpa"
        ],
        "ip": [
            "192.168.1.1"
        ]
    },
    "source": {
        "address": "192.168.1.1",
        "ip": "192.168.1.1"
    }
}

{
    "message": "2019-10-09T18:29:22+02:00 hostfoo unbound[3888]: [3888:1f] info: 192.168.1.1 1.1.168.192.in-addr.arpa. PTR IN",
    "dns": {
        "question": {
            "class": "IN",
            "name": "1.1.168.192.in-addr.arpa",
            "registered_domain": "192.in-addr.arpa",
            "subdomain": "1.1.168",
            "top_level_domain": "in-addr.arpa",
            "type": "PTR"
        },
        "size_in_char": 24,
        "type": "query"
    },
    "host": {
        "name": "hostfoo"
    },
    "related": {
        "hosts": [
            "1.1.168.192.in-addr.arpa"
        ],
        "ip": [
            "192.168.1.1"
        ]
    },
    "source": {
        "address": "192.168.1.1",
        "ip": "192.168.1.1"
    }
}

{
    "message": "2019-10-08T11:29:05+02:00 hostfoo unbound[17265]: [6634:16] info: server stats for thread 0: 11982 queries, 9074 answers from cache, 2908 recursions, 1029 prefetch, 0 rejected by ip ratelimiting",
    "host": {
        "name": "hostfoo"
    }
}

{
    "message": "[16667:e] info: 192.168.1.1 _ldap._tcp.SXB._sites.dc._msdcs.key.corp.net. SRV IN",
    "dns": {
        "question": {
            "class": "IN",
            "name": "_ldap._tcp.SXB._sites.dc._msdcs.key.corp.net",
            "registered_domain": "corp.net",
            "subdomain": "_ldap._tcp.SXB._sites.dc._msdcs.key",
            "top_level_domain": "net",
            "type": "SRV"
        },
        "size_in_char": 44,
        "type": "query"
    },
    "related": {
        "hosts": [
            "_ldap._tcp.SXB._sites.dc._msdcs.key.corp.net"
        ],
        "ip": [
            "192.168.1.1"
        ]
    },
    "source": {
        "address": "192.168.1.1",
        "ip": "192.168.1.1"
    }
}

Extracted Fields

The following table lists the fields that are extracted, normalized under the ECS format, analyzed and indexed by the parser. It should be noted that infered fields are not listed.

Name Type Description
dns.question.class keyword The class of records being queried.
dns.question.name keyword The name being queried.
dns.question.type keyword The type of record being queried.
dns.size_in_char number
dns.type keyword The type of DNS event captured, query or answer.
error.message match_only_text Error message.
error.type keyword The type of the error, for example the class name of the exception.
host.name keyword Name of the host.
source.domain keyword The domain name of the source.
source.ip ip IP address of the source.
source.port long Port of the source.
user.id keyword Unique identifier of the user.
user.name keyword Short name or login of the user.

Configure

This setup guide will show you how to forward logs produced by your Unbound server to Sekoia.io by means of an rsyslog transport channel.

Configure the Rsyslog server

Please consult the Rsyslog Transport documentation to forward these logs to Sekoia.io.