Windows DNS Server: Failed DNS Zone Transfer (Event ID 6004)

Alerts on Windows DNS Server Event ID 6004 indicating a failed DNS zone transfer request for a non-existent or non-authoritative zone.

FreeUnreviewedSigmamediumv1

windows-dns-server-failed-dns-zone-transfer-event-id-6004-6d444368

title: "Windows DNS Server: Failed DNS Zone Transfer (Event ID 6004)"
id: 2f45d857-8d84-4cbe-902c-17696d3ded0b
status: test
description: This rule flags Windows DNS Server events where a zone transfer request was received for a non-existent or non-authoritative DNS zone. Failed zone transfers can indicate reconnaissance attempts to enumerate DNS records or to test misconfigurations, even when the transfer does not succeed. It relies on DNS Server service telemetry for Event ID 6004.
references:
  - https://kb.eventtracker.com/evtpass/evtpages/EventId_6004_Microsoft-Windows-DNS-Server-Service_65410.asp
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/dns_server/win_dns_server_failed_dns_zone_transfer.yml
author: Zach Mathis, Huntrule Team
date: 2023-05-24
tags:
  - attack.reconnaissance
  - attack.t1590.002
logsource:
  product: windows
  service: dns-server
detection:
  selection:
    EventID: 6004
  condition: selection
falsepositives:
  - Unlikely
level: medium
license: DRL-1.1
related:
  - id: 6d444368-6da1-43fe-b2fc-44202430480e
    type: derived

What it detects

This rule flags Windows DNS Server events where a zone transfer request was received for a non-existent or non-authoritative DNS zone. Failed zone transfers can indicate reconnaissance attempts to enumerate DNS records or to test misconfigurations, even when the transfer does not succeed. It relies on DNS Server service telemetry for Event ID 6004.

Known false positives

Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.