Phoenix
Sigma IntelligenceBeta
Back to Rules
Detectionlowtest

New Kind of Network (NKN) Detection

NKN is a networking service using blockchain technology to support a decentralized network of peers. While there are legitimate uses for it, it can also be used as a C2 channel. This rule looks for a DNS request to the ma>

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch
Michael PorteraCreated Thu Apr 21fa7703d6-0ee8-4949-889c-48c84bc15b6fnetwork
Log Source
Zeek (Bro)dns
ProductZeek (Bro)← raw: zeek
Servicedns← raw: dns
Detection Logic
Detection Logic1 selector
detection:
    selection:
        query|contains|all:
            - 'seed'
            - '.nkn.org'
    condition: selection
False Positives
Unknown

False positive likelihood has not been assessed. Additional context may be needed during triage.

References
1
Resolving title…
github.com
2
Resolving title…
unit42.paloaltonetworks.com
3
Resolving title…
github.com
MITRE ATT&CK
Rule Metadata
Rule ID
fa7703d6-0ee8-4949-889c-48c84bc15b6f
Status
test
Level
low
Type
Detection
Created
Thu Apr 21
Author
Michael Portera
Path
rules/network/zeek/zeek_dns_nkn.yml
Raw Tags
attack.command-and-control
View on GitHub