Windows: Unusual File Modification by dns.exe
Alert on dns.exe changing files other than dns.log, which can indicate suspicious or compromised system activity.
- Product
- windows
- Category
- file_change
- Author
- Tim Rauch (Nextron Systems), Elastic (idea) (SigmaHQ), DRL 1.1
- Published
- 2022-09-27
- Updated
- 2026-07-31
ATT&CK techniques
Initial Access → PersistenceRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags file change events where the modifying process is dns.exe, excluding cases where the target ends with \dns.log. Unexpected modifications by a system DNS component can indicate malicious persistence or exploitation attempts. The detection relies on Windows file modification telemetry including the full process image path and the target filename being changed.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows: Unusual File Modification by dns.exe"
id: 606c973a-5473-413f-81b3-1e036e31f761
related:
- id: 8f0b1fb1-9bd4-4e74-8cdf-a8de4d2adfd0
type: similar
- id: 9f383dc0-fdeb-4d56-acbc-9f9f4f8f20f3
type: derived
status: test
description: This rule flags file change events where the modifying process is dns.exe, excluding cases where the target ends with \dns.log. Unexpected modifications by a system DNS component can indicate malicious persistence or exploitation attempts. The detection relies on Windows file modification telemetry including the full process image path and the target filename being changed.
references:
- https://www.elastic.co/guide/en/security/current/unusual-file-modification-by-dns-exe.html
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_change/file_change_win_unusual_modification_by_dns_exe.yml
author: Tim Rauch (Nextron Systems), Elastic (idea), Huntrule Team
date: 2022-09-27
tags:
- attack.persistence
- attack.initial-access
- attack.t1133
logsource:
category: file_change
product: windows
detection:
selection:
Image|endswith: \dns.exe
filter:
TargetFilename|endswith: \dns.log
condition: selection and not filter
falsepositives:
- Unknown
level: high
license: DRL-1.1