↳ GitHub sourceAnalytics ruleMedium

Detect excessive NXDOMAIN DNS queries - Static threshold based (ASIM DNS Solution)

Description

'This rule generates an alert when the configured threshold for DNS queries to non-existent domains is breached. This helps in identifying possible C2 communications. It utilizes [ASIM](https://aka.ms/AboutASIM) normalization and is applied to any source that supports the ASIM DNS schema.'

Rule type: Scheduled
Version: 1.0.2
Declared status: Available
Query frequency: 1h
Query period: 1h
Trigger: gt 0

Declared MITRE coverage

KQL query

Original query, unchanged.

let lookback = 1h;
let threshold = 200;
_Im_Dns(starttime=ago(lookback), responsecodename='NXDOMAIN')
| summarize NXDOMAINCount=count() by SrcIpAddr, bin(TimeGenerated, 15m)
| where NXDOMAINCount > threshold
| join kind=inner (_Im_Dns(starttime=ago(lookback), responsecodename='NXDOMAIN')
  | summarize DNSQueries = makeset(DnsQuery) by SrcIpAddr)
  on SrcIpAddr
| extend NXDOMAINthreshold=threshold
| project-away SrcIpAddr1

Declared entities

Source provenance

GitHub

Displayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.

File: Solutions/DNS Essentials/Analytic Rules/ExcessiveNXDOMAINDNSQueriesStaticThresholdBased.yaml ↗
Commit: 9800e51 ↗
Source identifier: 4ab8b09e-3c23-4974-afbe-7e653779eb2b

Additional source files 2

Solutions/DNS Essentials/Analytic Rules/ExcessiveNXDOMAINDNSQueriesStaticThresholdBased.yamlsource ↗Solutions/DNS Essentials/Data/Solution_DNS.jsonsolution-membership ↗

GSTEP / CATALOG TRACKING

Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC

GSTEP sync dates, separate from the source content’s publication dates.