Linux syslog: Detect suspicious BIND/named error messages

ATT&CK techniques

Initial Access

Recon
Resource Dev
Initial Access
- T1190Exploit Public-Facing Application
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule matches specific error strings in Linux syslog associated with BIND/named, including fatal-exit indications and denied or dropped packet conditions. Such messages can reflect probing or exploitation attempts that trigger unexpected server behavior or access denials (for example, attempting restricted DNS operations). It relies on syslog text containing the configured keyword phrases from the named service.

Reporting behind it

Related detections9 linkedT1190 — drag to rearrange

Malicious SharePoint ToolShell Exploitation via ToolPane Endpoint

Malicious Exchange Mailbox Export to ASPX via New-MailboxExportRequest

Suspicious Shell Spawned by ActiveMQ Java Process

Cleo Autorun Exploitation via Healthcheck File Drop

Suspicious SharePoint Worker Process Spawning Command Interpreter via ToolShell

Malicious IIS Worker Process Spawning Command Shell Reconnaissance

Potential StyleSmuggler (CVE-2026-75650) Exploitation Attempt - Magento GraphQL Styles Parameter (via webserver)

Cisco IOS XE Configuration Change by Web UI WSMA User

Possible React2Shell CVE-2025-55182 Prototype Pollution Exploitation

Linux syslog: Detect suspicious BIND/named error messages

Pivot detection · T1190 · 9 related

Changelog

v3

v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

linux-syslog-suspicious-bind-named-error-messages-fatal-or-access-denied-c8e35e96

title: "Linux syslog: Detect suspicious BIND/named error messages"
id: a34c0ce4-6d3d-4465-981e-e5e2b710169d
status: test
description: This rule matches specific error strings in Linux syslog associated with BIND/named, including fatal-exit indications and denied or dropped packet conditions. Such messages can reflect probing or exploitation attempts that trigger unexpected server behavior or access denials (for example, attempting restricted DNS operations). It relies on syslog text containing the configured keyword phrases from the named service.
references:
  - https://github.com/ossec/ossec-hids/blob/1ecffb1b884607cb12e619f9ab3c04f530801083/etc/rules/named_rules.xml
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/builtin/syslog/lnx_syslog_susp_named.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2018-02-20
modified: 2022-10-05
tags:
  - attack.initial-access
  - attack.t1190
logsource:
  product: linux
  service: syslog
detection:
  keywords:
    - " dropping source port zero packet from "
    - " denied AXFR from "
    - " exiting (due to fatal error)"
  condition: keywords
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: c8e35e96-19ce-4f16-aeb6-fd5588dc5365
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL