Windows: Detect dnscmd.exe setting ServerLevelPluginDll to install DNS plugin DLL
Flags dnscmd.exe DNS configuration that sets ServerLevelPluginDll, indicating potential malicious DNS server code injection.
- Product
- windows
- Category
- process_creation
- Author
- Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2017-05-08
- Updated
- 2026-07-31
ATT&CK techniques
Execution → Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies process executions of dnscmd.exe where the command line includes both /config and /serverlevelplugindll, indicating a DNS ServerLevelPluginDll has been set. Attackers can use this behavior to load a malicious plugin DLL by leveraging the DNS server context, typically requiring a restart to take effect. Telemetry relies on Windows process creation logs capturing the executable path and full command line arguments.
Reporting behind it
- medium.comhttps://medium.com/@esnesenon/feature-not-bug-dnsadmin-to-dc-compromise-in-one-line-a0f779b8dc83
- blog.3or.dehttps://blog.3or.de/hunting-dns-server-level-plugin-dll-injection.html
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_dnscmd_install_new_server_level_plugin_dll.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows: Detect dnscmd.exe setting ServerLevelPluginDll to install DNS plugin DLL"
id: 5e7084e3-379e-4f8b-be7a-8272e2fcf424
related:
- id: e61e8a88-59a9-451c-874e-70fcc9740d67
type: derived
- id: cbe51394-cd93-4473-b555-edf0144952d9
type: derived
- id: f63b56ee-3f79-4b8a-97fb-5c48007e8573
type: derived
status: test
description: This rule identifies process executions of dnscmd.exe where the command line includes both /config and /serverlevelplugindll, indicating a DNS ServerLevelPluginDll has been set. Attackers can use this behavior to load a malicious plugin DLL by leveraging the DNS server context, typically requiring a restart to take effect. Telemetry relies on Windows process creation logs capturing the executable path and full command line arguments.
references:
- https://medium.com/@esnesenon/feature-not-bug-dnsadmin-to-dc-compromise-in-one-line-a0f779b8dc83
- https://blog.3or.de/hunting-dns-server-level-plugin-dll-injection.html
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_dnscmd_install_new_server_level_plugin_dll.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2017-05-08
modified: 2023-02-05
tags:
- attack.privilege-escalation
- attack.persistence
- attack.execution
- attack.stealth
- attack.defense-impairment
- attack.t1574.001
- attack.t1112
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith: \dnscmd.exe
CommandLine|contains|all:
- /config
- /serverlevelplugindll
condition: selection
falsepositives:
- Unknown
level: high
license: DRL-1.1