Windows: Unusual Child Process Spawn by dns.exe

Alerts when dns.exe launches an unexpected child process other than conhost.exe.

FreeReviewedSigma · High · v2
Product
windows
Category
process_creation
Author
Tim Rauch, Elastic (idea) (SigmaHQ), DRL 1.1
Published
2022-09-27
Updated
2026-07-31
title: "Windows: Unusual Child Process Spawn by dns.exe"
id: 6766c383-2fce-4cd0-89dc-69082bf8344b
status: test
description: This rule flags process creation events where the parent process name ends with '\dns.exe' and the child process is not '\conhost.exe'. Spawning unexpected children from dns.exe can indicate malicious activity, including post-exploitation behaviors, and is a useful signal for spotting exploitation or persistence attempts. It relies on Windows process creation telemetry, using parent and image path suffix matching to identify anomalous process trees.
references:
  - https://www.elastic.co/guide/en/security/current/unusual-child-process-of-dns-exe.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_dns_susp_child_process.yml
author: Tim Rauch, Elastic (idea), Huntrule Team
date: 2022-09-27
modified: 2023-02-05
tags:
  - attack.persistence
  - attack.initial-access
  - attack.t1133
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \dns.exe
  filter:
    Image|endswith: \conhost.exe
  condition: selection and not filter
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: a4e3d776-f12e-42c2-8510-9e6ed1f43ec3
    type: derived