Linux syslog: Detect suspicious BIND/named error messages

Alerts on Linux syslog messages with BIND named fatal or denied DNS error strings.

FreeReviewedSigma · High · v3

Product: linux
Service: syslog
Author: Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2018-02-20
Updated: 2026-07-31

ATT&CK techniques

Initial Access

Recon
Resource Dev
Initial Access
- T1190Exploit Public-Facing Application
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule matches specific error strings in Linux syslog associated with BIND/named, including fatal-exit indications and denied or dropped packet conditions. Such messages can reflect probing or exploitation attempts that trigger unexpected server behavior or access denials (for example, attempting restricted DNS operations). It relies on syslog text containing the configured keyword phrases from the named service.

Reporting behind it

Related detections9 linkedT1190 — drag to rearrange

Malicious Veeam CVE-2023-27532 Exploitation Enabling xp_cmdshell via VeeamHax (via process_creation)

Suspicious PraisonAI Unauthenticated Config Endpoint Access via Webserver

Malicious Langflow Build Public Temp RCE Access via Webserver

Suspicious PraisonAI Vulnerability Scanner User Agent via Webserver

Malicious LiteLLM Authentication SQL Injection via Web Request (via webserver)

Possible Marimo Unauthenticated Terminal WebSocket Access via Web Request (via webserver)

Possible React2Shell Next.js Prototype Pollution Exploitation via Web Request (via webserver)

Malicious Marimo Notebook Credential File Access via Shell (via process_creation)

Malicious Ingress-nginx Configuration Injection via Kubernetes Audit (via kubernetes)

Linux syslog: Detect suspicious BIND/named error messages

Pivot detection · T1190 · 9 related

Changelog

v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

linux-syslog-suspicious-bind-named-error-messages-fatal-or-access-denied-c8e35e96

title: "Linux syslog: Detect suspicious BIND/named error messages"
id: a34c0ce4-6d3d-4465-981e-e5e2b710169d
status: test
description: This rule matches specific error strings in Linux syslog associated with BIND/named, including fatal-exit indications and denied or dropped packet conditions. Such messages can reflect probing or exploitation attempts that trigger unexpected server behavior or access denials (for example, attempting restricted DNS operations). It relies on syslog text containing the configured keyword phrases from the named service.
references:
  - https://github.com/ossec/ossec-hids/blob/1ecffb1b884607cb12e619f9ab3c04f530801083/etc/rules/named_rules.xml
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/builtin/syslog/lnx_syslog_susp_named.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2018-02-20
modified: 2022-10-05
tags:
  - attack.initial-access
  - attack.t1190
logsource:
  product: linux
  service: syslog
detection:
  keywords:
    - " dropping source port zero packet from "
    - " denied AXFR from "
    - " exiting (due to fatal error)"
  condition: keywords
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: c8e35e96-19ce-4f16-aeb6-fd5588dc5365
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL