Windows DNS Server CVE-2020-1350 RCE Indicators via Suspicious Child Process Creation
Alerts on non-benign subprocesses spawned by Windows DNS (dns.exe), consistent with CVE-2020-1350 exploitation attempts.
- Product
- windows
- Category
- process_creation
- Author
- Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2020-07-15
- Updated
- 2026-07-31
ATT&CK techniques
Initial Access → ExecutionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies Windows process creation events where a child process is spawned by the DNS service (dns.exe) while the child is not one of several known benign Windows components. Such parent-child execution patterns are relevant because DNS RCE exploitation would involve dns.exe launching unusual sub-processes. Telemetry required is process creation events that include parent image paths and child image paths.
Reporting behind it
- research.checkpoint.comhttps://research.checkpoint.com/2020/resolving-your-way-into-domain-admin-exploiting-a-17-year-old-bug-in-windows-dns-servers/
- web.archive.orghttps://web.archive.org/web/20230329172447/https://blog.menasec.net/2019/02/threat-hunting-24-microsoft-windows-dns.html
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2020/Exploits/CVE-2020-1350/proc_creation_win_exploit_cve_2020_1350.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows DNS Server CVE-2020-1350 RCE Indicators via Suspicious Child Process Creation
id: 54724b8c-ffb4-4b97-84a1-03f209331e2b
status: test
description: This rule identifies Windows process creation events where a child process is spawned by the DNS service (dns.exe) while the child is not one of several known benign Windows components. Such parent-child execution patterns are relevant because DNS RCE exploitation would involve dns.exe launching unusual sub-processes. Telemetry required is process creation events that include parent image paths and child image paths.
references:
- https://research.checkpoint.com/2020/resolving-your-way-into-domain-admin-exploiting-a-17-year-old-bug-in-windows-dns-servers/
- https://web.archive.org/web/20230329172447/https://blog.menasec.net/2019/02/threat-hunting-24-microsoft-windows-dns.html
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2020/Exploits/CVE-2020-1350/proc_creation_win_exploit_cve_2020_1350.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2020-07-15
modified: 2022-07-12
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1569.002
- cve.2020-1350
- detection.emerging-threats
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: \System32\dns.exe
filter:
Image|endswith:
- \System32\werfault.exe
- \System32\conhost.exe
- \System32\dnscmd.exe
- \System32\dns.exe
condition: selection and not filter
falsepositives:
- Unknown but benign sub processes of the Windows DNS service dns.exe
level: critical
license: DRL-1.1
related:
- id: b5281f31-f9cc-4d0d-95d0-45b91c45b487
type: derived