Windows dns.exe Modifies Unexpected Files

Alert on dns.exe changing files other than dns.log, which can indicate suspicious or compromised system activity.

FreeUnreviewedSigmahighv1

windows-dns-exe-modifies-unexpected-files-9f383dc0

title: Windows dns.exe Modifies Unexpected Files
id: 606c973a-5473-413f-81b3-1e036e31f761
related:
  - id: 8f0b1fb1-9bd4-4e74-8cdf-a8de4d2adfd0
    type: similar
  - id: 9f383dc0-fdeb-4d56-acbc-9f9f4f8f20f3
    type: derived
status: test
description: This rule flags file change events where dns.exe (the Windows DNS client binary) modifies a file path that is not the expected dns.log. Unusual modifications by a legitimate system process can indicate compromise, persistence, or other exploitation activity. The detection relies on Windows file change telemetry that records the modifying process image path and the target file name.
references:
  - https://www.elastic.co/guide/en/security/current/unusual-file-modification-by-dns-exe.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_change/file_change_win_unusual_modification_by_dns_exe.yml
author: Tim Rauch (Nextron Systems), Elastic (idea), Huntrule Team
date: 2022-09-27
tags:
  - attack.persistence
  - attack.initial-access
  - attack.t1133
logsource:
  category: file_change
  product: windows
detection:
  selection:
    Image|endswith: \dns.exe
  filter:
    TargetFilename|endswith: \dns.log
  condition: selection and not filter
falsepositives:
  - Unknown
level: high
license: DRL-1.1

What it detects

This rule flags file change events where dns.exe (the Windows DNS client binary) modifies a file path that is not the expected dns.log. Unusual modifications by a legitimate system process can indicate compromise, persistence, or other exploitation activity. The detection relies on Windows file change telemetry that records the modifying process image path and the target file name.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.