huntrule

Windows dns.exe Deletes Files Not Targeting dns.log

Alerts when dns.exe deletes any file other than dns.log on Windows.

FreeUnreviewedSigmahighv1
title: Windows dns.exe Deletes Files Not Targeting dns.log
id: a5994949-18c8-4df7-856d-9ce534bd5800
related:
  - id: 9f383dc0-fdeb-4d56-acbc-9f9f4f8f20f3
    type: similar
  - id: 8f0b1fb1-9bd4-4e74-8cdf-a8de4d2adfd0
    type: derived
status: test
description: This rule flags file deletions initiated by dns.exe when the deleted file is not dns.log. Unexpected cleanup by the DNS service process can indicate malicious activity, including persistence or other exploitation workflows that involve manipulating files. It relies on Windows file deletion telemetry that includes the deleting process path (Image) and the deleted file path (TargetFilename), then excludes deletions of dns.log to reduce noise.
references:
  - https://www.elastic.co/guide/en/security/current/unusual-file-modification-by-dns-exe.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_delete/file_delete_win_unusual_deletion_by_dns_exe.yml
author: Tim Rauch (Nextron Systems), Elastic (idea), Huntrule Team
date: 2022-09-27
modified: 2023-02-15
tags:
  - attack.persistence
  - attack.initial-access
  - attack.t1133
logsource:
  category: file_delete
  product: windows
detection:
  selection:
    Image|endswith: \dns.exe
  filter:
    TargetFilename|endswith: \dns.log
  condition: selection and not filter
falsepositives:
  - Unknown
level: high
license: DRL-1.1

What it detects

This rule flags file deletions initiated by dns.exe when the deleted file is not dns.log. Unexpected cleanup by the DNS service process can indicate malicious activity, including persistence or other exploitation workflows that involve manipulating files. It relies on Windows file deletion telemetry that includes the deleting process path (Image) and the deleted file path (TargetFilename), then excludes deletions of dns.log to reduce noise.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.