DNS query with an abnormally long leftmost label

Siemphony@siemphonylowT1001.001unverified

AN0030 describes junk characters padded into a command-and-control protocol, measured by MITRE's PayloadEntropyThreshold knob and by a send-to-receive ratio. Neither is available on the analytic's network-connection source — Sysmon EventID 3 carries addresses and ports and no byte counts at all — so the rule is built on the other source the analytic supplies, EventID 22, where the query name *is* the payload and the padding is therefore visible on a single event. The regex requires the leftmost label to be 45 or more characters of label-legal alphanumerics and hyphens before the first dot, which is the closest a single-event Sigma rule gets to an entropy test: junk inserted between significant characters lengthens the label whatever the encoding, while ordinary hostnames are short because humans type them. Read that as a proxy and not as a measurement, because it cuts both ways — a padded channel that keeps its labels short is missed entirely, and a long dictionary-word hostname alerts. The other forms of junk data MITRE covers, padding inside HTTP bodies or a raw TCP stream, leave no trace on any log source in this strategy and are outside what this rule can reach. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0011, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 2 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Splunk · SPL

Run this as a search.

index=* | where match(QueryName, "^[A-Za-z0-9-]{45,}\\.")

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,dns_query,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="QueryName" type="pcre2">(?i)^[A-Za-z0-9-]{45,}\.</field>    <description>DNS query with an abnormally long leftmost label</description>    <mitre>      <id>T1001.001</id>    </mitre>  </rule></group>

Sentinel · KQL

Run this as a search.

Sentinel cannot express this construct. No Sentinel table is modelled for this logsource ({"category":"dns_query","product":"windows"}), so there is nothing honest to query. Pick a logsource this translator maps, or write the KQL by hand. The Sigma source is on the first tab, unchanged.

Elastic · ES|QL

Run this as a search.

Elastic cannot express this construct. ES|QL RLIKE uses Lucene regexp syntax, which has no case-insensitive flag, and Sigma regexes are case-insensitive. Use |contains/|startswith/|endswith, or write the ES|QL by hand. The Sigma source is on the first tab, unchanged.

At a glance

Logsource: dns_query / windows
Level: low
Category: data_staging_exfil
Sigma status: experimental
Backends: 2 of 4 rendered
Updated: 30 Aug 2026
Rule ID: c1eb6448-b94a-4b62-a810-1c2b618a7815

ATT&CKT1001.001

T1001.001Junk Data

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessondata staging exfil

data staging exfilAI draft — unreviewed

01 · What this rule detects

A single Sysmon EventID 22 DNS query whose leftmost label is 45 or more characters of alphanumerics and hyphens. Start with what MITRE asked for, because the gap is the whole story. AN0030 wants "large outbound connections with disproportionate send/receive ratios," measured through a PayloadEntropyThreshold knob, over a TimeWindow. Every one of those is a quantity computed across many events. Sigma has no aggregation and no time window, and the analytic's primary source — Sysmon EventID 3 — carries addresses and ports and no byte counts at all, so the ratio has no fields to bind to. So the author moved to the analytic's other source, EventID 22, on one insight: in a DNS query the name is the payload, so padding is visible on a single event. Label length stands in for entropy. That is a proxy, not a measurement.

02 · Telemetry you need

category: dns_query / product: windows, from AN0030's EventID 22 entry.
The prerequisite the rule fails to state. EventID 22 needs Sysmon v10 or later and an explicit DnsQuery block in the running configuration. It is the noisiest event Sysmon produces; common community configs exclude large parts of it and many estates turn it off outright. The reviewer flagged this as a contract miss, and it matters more here than in most rules: a zero-row result reads as "no tunnelling" when it usually means "no DNS logging."
Two of four backends refuse this rule. Sentinel has no table modelled for dns_query/windows; Elastic ES|QL refuses because Lucene regexp has no case-insensitive flag and Sigma regexes are case-insensitive. Reaching for |re is a real cost, not a free upgrade over contains.

03 · How the logic works

One field, one regex:

Read it left to right. ^ anchors at the start of the name. [A-Za-z0-9-] is the label-legal character set. {45,} is the threshold. \. terminates at the first dot — so the pattern only ever inspects the leftmost label. The false-positive block says plainly that 45 is the author's number, not MITRE's; MITRE named PayloadEntropyThreshold and this log source has no field to bind it to. That honesty is the right instinct, though the reviewer notes it sits in a slot the contract reserves for a benign source and belongs in the description. Two consequences of the regex shape, both from the review: - The anchor is the evasion. a32.b31.c30.c2.example never matches, however much padding it carries. This is not contrived — DNS tunnels chunk into short labels routinely because of the 63-octet label limit and the 253-octet name limit, and several well-known implementations default below 45. The rule is blind to them before an adversary adapts. - The character class is a hard requirement across all 45 characters. One underscore or percent anywhere in the label and the match fails. And name the neighbour: a long opaque leftmost label is the textbook observable for DNS tunnelling. A hit is more likely T1071.004, T1048.003 or T1572 than junk padding specifically. Junk data inside an HTTP body or a raw TCP stream — which is most of what T1001.001 describes — leaves no trace on any source in this strategy.

04 · Common false positives

CDNs, cloud object storage and anti-malware cloud-reputation lookups put a hash
SaaS, MDM and telemetry endpoints embedding a tenant or device identifier — a
Protocols that encode data in names by design: DKIM selector lookups, DNSBL and

05 · Detection maturity

tier_1: .** UNVERIFIED — derived from DET0011, never run against a log line. The 45 is a guess never checked against a distribution of real query names.
tier_2: is unusually cheap here, because the tuning data is the data the rule reads: collect a week of EventID 22, plot leftmost-label length, and set the threshold where your own estate's tail actually starts. Rank the survivors by parent domain and by host and turn both into exclusions.
tier_3: restores what MITRE described — volume and entropy over a TimeWindow — which needs a streaming analytic, not a Sigma rule.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Add `QueryStatus`. On the same event, and close to free specificity:
Suppress on the parent domain, never by raising 45. Raising the number
Exclude your resolvers and gateways by host, then look at what remains.
Cover the chunked case with a second selection — a regex requiring four or
Knobs that could not be implemented: PayloadEntropyThreshold (no payload

Declared by the author

Content-delivery networks, cloud object storage and anti-malware cloud-reputation lookups, all of which put a long hash or opaque token in the leftmost label. These fire continuously on every host and will outnumber everything else the rule returns, so treat it as a hunting lead over the Image field rather than an alert until the parent domains behind them are suppressed — suppression belongs on the domain, not on the length threshold.
Enterprise SaaS, device-management and telemetry endpoints that embed a tenant or device identifier in the hostname. A 36-character GUID plus any prefix clears 45 characters on its own, so these are a permanent floor of matches under a handful of stable parent domains.
DNS-based protocols that encode data in names by design and are entirely benign: DKIM selector lookups, DNSBL and RBL queries that prepend a reversed address, and certificate or DANE lookups.
The threshold is arbitrary and mine, not MITRE's — MITRE names PayloadEntropyThreshold and this log source has no field to bind it to. Raising it above 45 trades recall for volume with no principled place to stop.

Noise checkdid not run

The Sigma source did not build into an evaluable rule, so the check did not run. this rule uses a regular expression, which is not evaluated here — an untrusted pattern can be made to run for a very long time

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verificationnone

Never run

The lab has not evaluated this composition. A run needs a dataset of its log type — a capture of the technique it claims, or the benign baseline — and not every rule has one. Some are also held back by the evaluator’s own safety limits.

Other compositions here have been run and some carry the badge — this one has not, so nothing about it has been shown either way. Read the rule and its noise check on their own terms; silence here is the absence of evidence, not evidence of a problem.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1001.001, evaluated against their dns_query events.

Share this rule

/u/siemphony/c1eb6448-b94a-4b62-a810-1c2b618a7815

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

DNS query with an abnormally long leftmost label

The detection

detection.yml

Splunk · SPL

Wazuh · XML rule

Sentinel · KQL

Elastic · ES|QL

Community

Verdicts from engineers who deployed it