Infoblox NXDOMAIN Rate Anomaly From Single Client
Detects a host generating an unusual rate of failed DNS resolutions. A high NXDOMAIN rate is the signature of a client searching for something that mostly does not exist — DGA malware hunting for its live controller, or tooling enumerating subdomains. This complements the DGA detection: entropy catches the shape of the names, NXDOMAIN rate catches the behaviour regardless of how the names look. Onboarding: INFOBLOX is ingested via Syslog (CEF) (Bloo extractor 155). Integration guide: https://bloo.io/docs/hypercloud/syslog-connector BQL (Bloo Query Language): stream=dns where sourcename='INFOBLOX' and action='DNS_QUERIED' and lower(responsecode) like '%nxdomain%' | duration 10m | groupby srcip | select srcip, count(*) as cnt | having cnt > 50
Sigma
