Windows DNS service DNS.exe process anomalies indicating CVE-2020-1350 RCE exploitation

Alerts on non-benign subprocesses spawned by Windows DNS (dns.exe), consistent with CVE-2020-1350 exploitation attempts.

FreeUnreviewedSigmacriticalv1

windows-dns-service-dns-exe-process-anomalies-indicating-cve-2020-1350-rce-explo-b5281f31

title: Windows DNS service DNS.exe process anomalies indicating CVE-2020-1350 RCE exploitation
id: 54724b8c-ffb4-4b97-84a1-03f209331e2b
status: test
description: This rule flags suspicious child process creation where the parent process is the Windows DNS service (dns.exe). It matters because exploiting the DNS remote code execution vulnerability can lead to unauthorized code execution under the DNS service context. The detection relies on Windows process creation telemetry, specifically the ParentImage ending with \System32\dns.exe, and excludes a small set of commonly seen benign subprocesses (werfault.exe, conhost.exe, dnscmd.exe, and dns.exe itself).
references:
  - https://research.checkpoint.com/2020/resolving-your-way-into-domain-admin-exploiting-a-17-year-old-bug-in-windows-dns-servers/
  - https://web.archive.org/web/20230329172447/https://blog.menasec.net/2019/02/threat-hunting-24-microsoft-windows-dns.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2020/Exploits/CVE-2020-1350/proc_creation_win_exploit_cve_2020_1350.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2020-07-15
modified: 2022-07-12
tags:
  - attack.initial-access
  - attack.t1190
  - attack.execution
  - attack.t1569.002
  - cve.2020-1350
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \System32\dns.exe
  filter:
    Image|endswith:
      - \System32\werfault.exe
      - \System32\conhost.exe
      - \System32\dnscmd.exe
      - \System32\dns.exe
  condition: selection and not filter
falsepositives:
  - Unknown but benign sub processes of the Windows DNS service dns.exe
level: critical
license: DRL-1.1
related:
  - id: b5281f31-f9cc-4d0d-95d0-45b91c45b487
    type: derived

What it detects

This rule flags suspicious child process creation where the parent process is the Windows DNS service (dns.exe). It matters because exploiting the DNS remote code execution vulnerability can lead to unauthorized code execution under the DNS service context. The detection relies on Windows process creation telemetry, specifically the ParentImage ending with \System32\dns.exe, and excludes a small set of commonly seen benign subprocesses (werfault.exe, conhost.exe, dnscmd.exe, and dns.exe itself).

Known false positives

Unknown but benign sub processes of the Windows DNS service dns.exe

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.