Windows: Unusual Child Process Spawn by dns.exe

Alerts when dns.exe launches an unexpected child process other than conhost.exe.

FreeReviewedSigma · High · v2

Product: windows
Category: process_creation
Author: Tim Rauch, Elastic (idea) (SigmaHQ), DRL 1.1
Published: 2022-09-27
Updated: 2026-07-31

ATT&CK techniques

Initial Access → Persistence

Recon
Resource Dev
Initial Access
- T1133External Remote Services
Execution
Persistence
- T1133External Remote Services
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags process creation events where the parent process name ends with '\dns.exe' and the child process is not '\conhost.exe'. Spawning unexpected children from dns.exe can indicate malicious activity, including post-exploitation behaviors, and is a useful signal for spotting exploitation or persistence attempts. It relies on Windows process creation telemetry, using parent and image path suffix matching to identify anomalous process trees.

Reporting behind it

Related detections9 linkedT1133 — drag to rearrange

Suspicious SonicWall NetExtender VPN Command-Line Authentication with Always-Trust (via process_creation)

Suspicious Reverse SSH Tunnel Creation with Host Key Verification Disabled (via process_creation)

Suspicious Shell Script Execution From Temp Directory on SonicWall SMA1000 Appliance (via process_creation)

Possible PAN-OS CVE-2026-0257 Exploitation via GlobalProtect PoC Artifacts (via network)

Possible RD Web Access Brute Force via Repeated Login POST Requests

Suspicious Security Group Ingress Rule Opened to the Internet via CloudTrail

SplashTop Network

Suspicious SoftEther VPN Hamcore Config Written to ProgramData (via file_event)

SplashTop Process

Windows: Unusual Child Process Spawn by dns.exe

Pivot detection · T1133 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-unusual-child-process-spawned-by-dns-exe-a4e3d776

title: "Windows: Unusual Child Process Spawn by dns.exe"
id: 6766c383-2fce-4cd0-89dc-69082bf8344b
status: test
description: This rule flags process creation events where the parent process name ends with '\dns.exe' and the child process is not '\conhost.exe'. Spawning unexpected children from dns.exe can indicate malicious activity, including post-exploitation behaviors, and is a useful signal for spotting exploitation or persistence attempts. It relies on Windows process creation telemetry, using parent and image path suffix matching to identify anomalous process trees.
references:
  - https://www.elastic.co/guide/en/security/current/unusual-child-process-of-dns-exe.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_dns_susp_child_process.yml
author: Tim Rauch, Elastic (idea), Huntrule Team
date: 2022-09-27
modified: 2023-02-05
tags:
  - attack.persistence
  - attack.initial-access
  - attack.t1133
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \dns.exe
  filter:
    Image|endswith: \conhost.exe
  condition: selection and not filter
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: a4e3d776-f12e-42c2-8510-9e6ed1f43ec3
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL