id: dns-saas-service-detection

info:
  name: DNS SaaS Service Detection
  author: noah @thesubtlety,pdteam
  severity: info
  description: A CNAME DNS record was discovered
  reference:
    - https://ns1.com/resources/cname
    - https://www.theregister.com/2021/02/24/dns_cname_tracking/
    - https://www.ionos.com/digitalguide/hosting/technical-matters/cname-record/
  metadata:
    max-request: 1
  tags: dns,service

dns:
  - name: "{{FQDN}}"
    type: CNAME

    extractors:
      - type: dsl
        dsl:
          - cname

    matchers-condition: or
    matchers:
      - type: word
        part: answer
        name: ms-office
        words:
          - outlook.com
          - office.com

      - type: word
        part: answer
        name: azure
        words:
          - "azure-api.net"
          - "azure.com"
          - "azure-mobile.net"
          - "azurecontainer.io"
          - "azurecr.io"
          - "azuredatalakestore.net"
          - "azureedge.net"
          - "azurefd.net"
          - "azurehdinsight.net"
          - "azurewebsites.net"
          - "azurewebsites.windows.net"
          - "blob.core.windows.net"
          - "cloudapp.azure.com"
          - "cloudapp.net"
          - "database.windows.net"
          - "redis.cache.windows.net"
          - "search.windows.net"
          - "servicebus.windows.net"
          - "visualstudio.com"
          - "-msedge.net"
          - "msappproxy.net"
          - "trafficmanager.net"

      - type: word
        part: answer
        name: zendesk
        words:
          - "zendesk.com"

      - type: word
        part: answer
        name: announcekit
        words:
          - "cname.announcekit.app"

      - type: word
        part: answer
        name: wix
        words:
          - "wixdns.net"

      - type: word
        part: answer
        name: akamai-cdn
        words:
          - akadns.net
          - akagtm.org
          - akahost.net
          - akam.net
          - akamai.com
          - akamai.net
          - akamaiedge-staging.net
          - akamaiedge.net
          - akamaientrypoint.net
          - akamaihd.net
          - akamaistream.net
          - akamaitech.net
          - akamaitechnologies.com
          - akamaitechnologies.fr
          - akamaized.net
          - akaquill.net
          - akasecure.net
          - akasripcn.net
          - edgekey.net
          - edgesuite.net

      - type: word
        part: answer
        name: cloudflare-cdn
        words:
          - cloudflare.net
          - cloudflare-dm-cmpimg.com
          - cloudflare-ipfs.com
          - cloudflare-quic.com
          - cloudflare-terms-of-service-abuse.com
          - cloudflare.com
          - cloudflare.net
          - cloudflare.tv
          - cloudflareaccess.com
          - cloudflareclient.com
          - cloudflareinsights.com
          - cloudflareok.com
          - cloudflareportal.com
          - cloudflareresolve.com
          - cloudflaressl.com
          - cloudflarestatus.com
          - sn-cloudflare.com

      - type: word
        part: answer
        name: amazon-cloudfront
        words:
          - cloudfront.net

      - type: word
        part: answer
        name: salesforce
        words:
          - salesforce.com
          - siteforce.com
          - force.com

      - type: word
        part: answer
        name: amazon-aws
        words:
          - amazonaws.com
          - elasticbeanstalk.com
          - awsglobalaccelerator.com

      - type: word
        part: answer
        name: fastly-cdn
        words:
          - fastly.net

      - type: word
        part: answer
        name: netlify
        words:
          - netlify.app
          - netlify.com
          - netlifyglobalcdn.com

      - type: word
        part: answer
        name: vercel
        words:
          - vercel.app

      - type: word
        part: answer
        name: sendgrid
        words:
          - sendgrid.net
          - sendgrid.com

      - type: word
        part: answer
        name: qualtrics
        words:
          - qualtrics.com

      - type: word
        part: answer
        name: heroku
        words:
          - herokuapp.com
          - herokucdn.com
          - herokudns.com
          - herokussl.com
          - herokuspace.com

      - type: word
        part: answer
        name: gitlab
        words:
          - gitlab.com
          - gitlab.io

      - type: word
        part: answer
        name: perforce-akana
        words:
          - akana.com
          - apiportal.akana.com

      - type: word
        part: answer
        name: skilljar
        words:
          - skilljarapp.com

      - type: word
        part: answer
        name: datagrail
        words:
          - datagrail.io

      - type: word
        part: answer
        name: platform.sh
        words:
          - platform.sh

      - type: word
        part: answer
        name: folloze
        words:
          - folloze.com

      - type: word
        part: answer
        name: pendo-receptive
        words:
          - receptive.io
          - pendo.io

      - type: word
        part: answer
        name: discourse
        words:
          - bydiscourse.com
          - discourse-cdn.com
          - discourse.cloud
          - discourse.org
          - hosted-by-discourse.com

      - type: word
        part: answer
        name: adobe-marketo
        words:
          - marketo.com
          - marketo.co.uk
          - mktoweb.com
          - mktossl.com
          - mktoweb.com

      - type: word
        part: answer
        name: adobe-marketo - 'mkto-.{5,8}\.com'

      - type: word
        part: answer
        name: adobe-marketo
        words:
          - marketo.com

      - type: word
        part: answer
        name: rock-content
        words:
          - postclickmarketing.com
          - rockcontent.com
          - rockstage.io

      - type: word
        part: answer
        name: rocketlane
        words:
          - rocketlane.com

      - type: word
        part: answer
        name: webflow
        words:
          - proxy-ssl.webflow.com

      - type: word
        part: answer
        name: stacker-hq
        words:
          - stacker.app

      - type: word
        part: answer
        name: hubspot
        words:
          - hs-analytics.net
          - hs-banner.com
          - hs-scripts.com
          - hsappstatic.net
          - hscollectedforms.net
          - hscoscdn00.net
          - hscoscdn10.net
          - hscoscdn20.net
          - hscoscdn30.net
          - hscoscdn40.net
          - hsforms.com
          - hsforms.net
          - hubapi.com
          - hubspot.com
          - hubspot.es
          - hubspot.net
          - hubspotemail.net
          - hubspotlinks.com
          - hubspotusercontent-na1.net
          - sidekickopen90.com
          - usemessages.com

      - type: word
        part: answer
        name: gitbook
        words:
          - gitbook.com
          - gitbook.io

      - type: word
        part: answer
        name: google-firebase
        words:
          - fcm.googleapis.com
          - firebase.com
          - firebase.google.com
          - firebase.googleapis.com
          - firebaseapp.com
          - firebaseappcheck.googleapis.com
          - firebasedynamiclinks-ipv4.googleapis.com
          - firebasedynamiclinks-ipv6.googleapis.com
          - firebasedynamiclinks.googleapis.com
          - firebaseinappmessaging.googleapis.com
          - firebaseinstallations.googleapis.com
          - firebaseio.com
          - firebaselogging-pa.googleapis.com
          - firebaselogging.googleapis.com
          - firebaseperusertopics-pa.googleapis.com
          - firebaseremoteconfig.googleapis.com

      - type: word
        part: answer
        name: zendesk
        words:
          - zdassets.com
          - zdorigin.com
          - "zendesk.com"
          - zopim.com

      - type: word
        part: answer
        name: imperva
        words:
          - incapdns.net
          - incapsula.com

      - type: word
        part: answer
        name: proofpoint
        words:
          - infoprtct.com
          - metanetworks.com
          - ppe-hosted.com
          - pphosted.com
          - proofpoint.com

      - type: word
        part: answer
        name: q4-investor-relations
        words:
          - q4inc.com
          - q4ir.com
          - q4web.com

      - type: word
        part: answer
        name: google-hosted
        words:
          - appspot.com
          - cloudfunctions.net
          - ghs.googlehosted.com
          - ghs4.googlehosted.com
          - ghs46.googlehosted.com
          - ghs6.googlehosted.com
          - googlehosted.com
          - googlehosted.l.googleusercontent.com
          - run.app

      - type: word
        part: answer
        name: wp-engine
        words:
          - wpengine.com

      - type: word
        part: answer
        name: github
        words:
          - github.com
          - github.io
          - githubusercontent.com

      - type: word
        part: answer
        name: ghost
        words:
          - ghost.io

      - type: word
        part: answer
        name: digital-ocean
        words:
          - ondigitalocean.app

      - type: word
        part: answer
        name: typedream
        words:
          - ontypedream.com

      - type: word
        part: answer
        name: oracle-eloqua-marketing
        words:
          - hs.eloqua.com

      - type: regex
        part: answer
        regex:
          - "IN\tCNAME\\t(.+)$"
          - "IN\\s*CNAME\\t(.+)$"
# digest: 490a0046304402205694ac1cba58232ec715831e94086da7081a9b756f86016358b1347a1a340787022040615d63a66787d706d2be8b3f13cead87f7278c471091a7783bfab4e4fa2aef:922c64590222798bb761d5b6d8e72950