New Or Rarely Seen Domains

Domains seen in the last 24h that haven't been seen recently — a classic new-domain-observed hunt.

KQL Library  /  Pi-hole

 Pi-hole new-or-rarely-seen-domains.kql

Domains seen in the last 24h that haven't been seen recently — a classic new-domain-observed hunt.

Tactics Command and Control
Techniques T1071.004
Platforms Pi-hole
Data pihole_CL
Deep Dive  Deep Dive
 Deep Dive  Download .kql 
// Author: Ian D. Hanley (DevSecOpsDad) | linkedin.com/in/ianhanley | devsecopsdad.com | devsecopsdadattack.com
//New or Rarely Seen Domains
// Source: Watching The DNS Watcher: Pihole Logs In Sentinel (2025-03-30) — https://www.hanley.cloud/2025-03-30-Watching-the-DNS-Watcher-Pihole-Logs-in-Sentinel/
// Tactics: Command and Control
// Techniques: T1071.004
// Platforms: Pi-hole
// Data: pihole_CL
let cutoff = ago(24h);
let recent = pihole_CL
| where TimeGenerated > cutoff
| summarize count() by DnsQuery_s;
let historic = pihole_CL
| where TimeGenerated <= cutoff
| summarize count() by DnsQuery_s;
recent
| join kind=leftanti historic on DnsQuery_s
| top 20 by count_

// Alternate query:
// Identify domains that have been queried for the first time or are rarely seen
PiHole
| summarize Count = count(), FirstSeen = min(TimeGenerated) by Domain  // Aggregate counts and first seen time by domain
| where Count < 5  // Filter for domains queried less than 5 times
| order by FirstSeen desc  // Order by the first seen time in descending order