LoFP LoFP / legitimate administration use

Techniques

Sample rules

Potential Discovery Activity Via Dnscmd.EXE

Description

Detects an attempt to leverage dnscmd.exe to enumerate the DNS zones of a domain. DNS zones used to host the DNS records for a particular domain.

Detection logic

condition: all of selection_*
selection_cli:
  CommandLine|contains:
  - /enumrecords
  - /enumzones
  - /ZonePrint
  - /info
selection_img:
  Image|endswith: \dnscmd.exe