Windows dnscmd.exe DNS Zone and Record Enumeration (Process Creation)

Flags dnscmd.exe executions that enumerate DNS zones/records via process creation command-line parameters.

FreeUnreviewedSigmamediumv1

windows-dnscmd-exe-dns-zone-and-record-enumeration-process-creation-b6457d63

title: Windows dnscmd.exe DNS Zone and Record Enumeration (Process Creation)
id: a612854f-d615-4ffc-baa1-5f4c283406c0
status: test
description: This rule identifies process executions of dnscmd.exe used with command-line flags associated with enumerating DNS zones and related DNS information. Attackers may use this discovery activity to map domain DNS structure before further targeting or abuse. The detection relies on Windows process creation telemetry, matching the dnscmd.exe executable path suffix and specific command-line parameters.
references:
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/dnscmd
  - https://learn.microsoft.com/en-us/azure/dns/dns-zones-records
  - https://lolbas-project.github.io/lolbas/Binaries/Dnscmd/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_dnscmd_discovery.yml
author: "@gott_cyber, Huntrule Team"
date: 2022-07-31
modified: 2023-02-04
tags:
  - attack.discovery
  - attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith: \dnscmd.exe
  selection_cli:
    CommandLine|contains:
      - /enumrecords
      - /enumzones
      - /ZonePrint
      - /info
  condition: all of selection_*
falsepositives:
  - Legitimate administration use
level: medium
license: DRL-1.1
related:
  - id: b6457d63-d2a2-4e29-859d-4e7affc153d1
    type: derived

What it detects

This rule identifies process executions of dnscmd.exe used with command-line flags associated with enumerating DNS zones and related DNS information. Attackers may use this discovery activity to map domain DNS structure before further targeting or abuse. The detection relies on Windows process creation telemetry, matching the dnscmd.exe executable path suffix and specific command-line parameters.

Known false positives

Legitimate administration use

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.