Windows dns.exe Deletes Files with Unexpected Targets
Alerts when dns.exe deletes any file other than dns.log on Windows.
FreeReviewedSigma · High · v2
- Product
- windows
- Category
- file_delete
- Author
- Tim Rauch (Nextron Systems), Elastic (idea) (SigmaHQ), DRL 1.1
- Published
- 2022-09-27
- Updated
- 2026-07-31
ATT&CK techniques
Initial Access → PersistenceRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags file deletions where the deleting process is dns.exe and the deleted target is not dns.log. Unexpected dns.exe file deletion can indicate malicious activity such as exploitation leading to unauthorized changes or cleanup. It relies on Windows file deletion telemetry that includes the process image path and the deleted target filename.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-dns-exe-deletes-files-not-targeting-dns-log-8f0b1fb1
title: Windows dns.exe Deletes Files with Unexpected Targets
id: a5994949-18c8-4df7-856d-9ce534bd5800
related:
- id: 9f383dc0-fdeb-4d56-acbc-9f9f4f8f20f3
type: similar
- id: 8f0b1fb1-9bd4-4e74-8cdf-a8de4d2adfd0
type: derived
status: test
description: This rule flags file deletions where the deleting process is dns.exe and the deleted target is not dns.log. Unexpected dns.exe file deletion can indicate malicious activity such as exploitation leading to unauthorized changes or cleanup. It relies on Windows file deletion telemetry that includes the process image path and the deleted target filename.
references:
- https://www.elastic.co/guide/en/security/current/unusual-file-modification-by-dns-exe.html
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_delete/file_delete_win_unusual_deletion_by_dns_exe.yml
author: Tim Rauch (Nextron Systems), Elastic (idea), Huntrule Team
date: 2022-09-27
modified: 2023-02-15
tags:
- attack.persistence
- attack.initial-access
- attack.t1133
logsource:
category: file_delete
product: windows
detection:
selection:
Image|endswith: \dns.exe
filter:
TargetFilename|endswith: \dns.log
condition: selection and not filter
falsepositives:
- Unknown
level: high
license: DRL-1.1