Windows: Unusual Child Process Spawn by dns.exe
Alerts when dns.exe launches an unexpected child process other than conhost.exe.
- Product
- windows
- Category
- process_creation
- Author
- Tim Rauch, Elastic (idea) (SigmaHQ), DRL 1.1
- Published
- 2022-09-27
- Updated
- 2026-07-31
ATT&CK techniques
Initial Access → PersistenceRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags process creation events where the parent process name ends with '\dns.exe' and the child process is not '\conhost.exe'. Spawning unexpected children from dns.exe can indicate malicious activity, including post-exploitation behaviors, and is a useful signal for spotting exploitation or persistence attempts. It relies on Windows process creation telemetry, using parent and image path suffix matching to identify anomalous process trees.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows: Unusual Child Process Spawn by dns.exe"
id: 6766c383-2fce-4cd0-89dc-69082bf8344b
status: test
description: This rule flags process creation events where the parent process name ends with '\dns.exe' and the child process is not '\conhost.exe'. Spawning unexpected children from dns.exe can indicate malicious activity, including post-exploitation behaviors, and is a useful signal for spotting exploitation or persistence attempts. It relies on Windows process creation telemetry, using parent and image path suffix matching to identify anomalous process trees.
references:
- https://www.elastic.co/guide/en/security/current/unusual-child-process-of-dns-exe.html
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_dns_susp_child_process.yml
author: Tim Rauch, Elastic (idea), Huntrule Team
date: 2022-09-27
modified: 2023-02-05
tags:
- attack.persistence
- attack.initial-access
- attack.t1133
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: \dns.exe
filter:
Image|endswith: \conhost.exe
condition: selection and not filter
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: a4e3d776-f12e-42c2-8510-9e6ed1f43ec3
type: derived