Windows dnscmd.exe DNS Zone and Record Enumeration Command Execution
Flags dnscmd.exe executions that enumerate DNS zones/records via process creation command-line parameters.
FreeReviewedSigma · Medium · v2
- Product
- windows
- Category
- process_creation
- Author
- @gott_cyber (SigmaHQ), DRL 1.1
- Published
- 2022-07-31
- Updated
- 2026-07-31
What it detects
This rule identifies process executions of dnscmd.exe where the command line contains DNS enumeration flags such as /enumrecords, /enumzones, /ZonePrint, or /info. Attackers and administrators can use dnscmd to discover DNS zone contents and configuration, which supports further targeting and internal recon. The detection relies on Windows process creation telemetry capturing the executable path and command-line arguments.
Reporting behind it
- learn.microsoft.comhttps://learn.microsoft.com/en-us/windows-server/administration/windows-commands/dnscmd
- learn.microsoft.comhttps://learn.microsoft.com/en-us/azure/dns/dns-zones-records
- lolbas-project.github.iohttps://lolbas-project.github.io/lolbas/Binaries/Dnscmd/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_dnscmd_discovery.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-dnscmd-exe-dns-zone-and-record-enumeration-process-creation-b6457d63
title: Windows dnscmd.exe DNS Zone and Record Enumeration Command Execution
id: a612854f-d615-4ffc-baa1-5f4c283406c0
status: test
description: This rule identifies process executions of dnscmd.exe where the command line contains DNS enumeration flags such as /enumrecords, /enumzones, /ZonePrint, or /info. Attackers and administrators can use dnscmd to discover DNS zone contents and configuration, which supports further targeting and internal recon. The detection relies on Windows process creation telemetry capturing the executable path and command-line arguments.
references:
- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/dnscmd
- https://learn.microsoft.com/en-us/azure/dns/dns-zones-records
- https://lolbas-project.github.io/lolbas/Binaries/Dnscmd/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_dnscmd_discovery.yml
author: "@gott_cyber, Huntrule Team"
date: 2022-07-31
modified: 2023-02-04
tags:
- attack.discovery
- attack.execution
logsource:
category: process_creation
product: windows
detection:
selection_img:
Image|endswith: \dnscmd.exe
selection_cli:
CommandLine|contains:
- /enumrecords
- /enumzones
- /ZonePrint
- /info
condition: all of selection_*
falsepositives:
- Legitimate administration use
level: medium
license: DRL-1.1
related:
- id: b6457d63-d2a2-4e29-859d-4e7affc153d1
type: derived