Scenario: A long-standing customer reported to your organization that they found a large number of your company's marketing plans and product roadmaps on a competitive intelligence website. You believed that your wonderful and loyal coworkers would never betray the organization like that, and your investigation showed you were right. It turns out that hackers used DNS to control compromised hosts and exfiltrate the data. You now need to set up monitoring so that this doesn't happen again.
How Splunk software can help
You can use Splunk software to monitor for changes that are indicators of data exfiltration. These include spikes in client volume, changes in resource type behavior, changes in packet size, hosts repeatedly checking in with the command infrastructure, and domains that have many subdomains.
What you need
The following technologies, data, and integrations are useful in successfully implementing this use case.
The best person to implement this use case is a security analyst who is familiar with network resolution data sources. This person might come from your team, a Splunk partner, or Splunk onDemand Services.
Setting up monitoring dashboards using Splunk software can take several hours, but after initial configuration, monitoring takes only minutes per day.
The following technologies, data, and integrations are useful in successfully implementing this use case:
- Splunk Enterprise or Splunk Cloud
- Data sources onboarded
- Network resolution (DNS) data
How to use Splunk software for this use case
You can run many searches with Splunk software to monitor DNS logs for signs of data exfiltration. Depending on what information you have available, you might find it useful to monitor for some or all of the following:
- Number of times a client has queried a DNS server
- Change in requests for specific resource record types
- Increases in packet size or volume distribution
- Signs of beaconing activity
- Excessive subdomains
- DNS tunneling through randomized subdomains
- DNS queries to randomized subdomains
- HTTP GET requests
Other steps you can take
To maximize their benefit, the how-to articles linked in the previous section likely need to tie into existing processes at your organization or become new standard processes. These processes commonly impact success with this use case:
- Developing access policies and conducting audits for compliance
- Identifying and classifying sensitive data
- Installing network perimeter and endpoint protection
These additional Splunk resources might help you understand and implement this use case:
- Blog: Detecting dynamic DNS domains in Splunk
- Conf Talk: Using Splunk and DNS to detect that your domains are being abused for phishing
- Splunk Solutions: Data exfiltration detection and prevention
How to assess your results
Measuring impact and benefit is critical to assessing the value of security operations. The following are example metrics that can be useful to monitor when implementing this use case:
- Number of positive exfiltration attempts identified: The number of investigations you initiated from your monitored data that were positive attempts are data exfiltration.