Using Data Tables in UDM Search and Yara-L Rule

Question

I’m trying to write a rule that checks the value of the “network.dns.questions.name” field, but will only trigger if the value is NOT in a data table using regex matching instead of a static value.

Assuming I have a data table named dns_tunnel_list with below values:

domain_names <« column header
example.invalid
does-not-exist.example.com
googleapis.com
metadata.google.internal

I cannot seem to get right a UDM search query that will ignore values from the above table with a query like below, for example:

metadata.log_type   = "GCP_DNS"
metadata.event_type = "NETWORK_DNS"

not network.dns.questions.name in regex %dns_tunnel_list.domain_names

Similarly, for a rule such as below:

rule LOG_SECOPS_005_dns_newly_seen_domain_v2 {

  meta:
    (snip)
    version         = "1.0"

  events:
    $dns.metadata.log_type   = "GCP_DNS"
    $dns.metadata.event_type = "NETWORK_DNS"

    $querying_ip = $dns.principal.ip
    $query_name  = $dns.network.dns.questions.name

    not $query_name in regex %dns_tunnel_list.domain_names 


  match:
    $querying_ip over 1h


  condition:

    $dns

}

Please, can I get some help.

thanks.

whathehack81 · Answer

The exclusion can be performed directly against the UDM field:

metadata.log_type = "GCP_DNS"
metadata.event_type = "NETWORK_DNS"
network.dns.questions.name != ""
not (
  network.dns.questions.name in regex
    %dns_tunnel_list.domain_names
)

For the detection rule:

rule LOG_SECOPS_005_dns_newly_seen_domain_v2 {
  meta:
    version = "1.0"

  events:
    $dns.metadata.log_type = "GCP_DNS"
    $dns.metadata.event_type = "NETWORK_DNS"

    $dns.network.dns.questions.name != ""

    $querying_ip = $dns.principal.ip
    $query_name = $dns.network.dns.questions.name

    not (
      $dns.network.dns.questions.name in regex
        %dns_tunnel_list.domain_names
    )

  match:
    $querying_ip over 1h

  condition:
    $dns
}

Make sure dns_tunnel_list.domain_names is an unmapped regex-type column. The values should also be valid regex expressions. For exact domain matching, escape the dots and anchor the expressions:

^example\.invalid$
^does-not-exist\.example\.com$
^googleapis\.com$
^metadata\.google\.internal$

To exclude both a parent domain and its subdomains, use:

(^|\.)googleapis\.com$

Using an unescaped value such as googleapis.com makes . a regex wildcard and, without anchors, may also match unintended substrings.

If only exact domain names are required, keep the column as String and remove the regex operator:

not (
  $dns.network.dns.questions.name in
    %dns_tunnel_list.domain_names
)

One final behavior to be aware of: network.dns.questions.name is repeated, and YARA-L evaluates repeated values through implicit unnesting. An event containing several DNS questions can therefore match when at least one question is outside the table.

Sign up

Login with SSO

Login to the community

Login with SSO