SigmaHQ/rules/windows/registry_event/sysmon_dns_serverlevelplugindll.yml

action: global
title: DNS ServerLevelPluginDll Install
id: e61e8a88-59a9-451c-874e-70fcc9740d67
status: experimental
description: Detects the installation of a plugin DLL via ServerLevelPluginDll parameter in Registry, which can be used to execute code in context of the DNS server
    (restart required)
references:
    - https://medium.com/@esnesenon/feature-not-bug-dnsadmin-to-dc-compromise-in-one-line-a0f779b8dc83
date: 2017/05/08
modified: 2020/09/06
author: Florian Roth
tags:
    - attack.defense_evasion
    - attack.t1073 # an old one
    - attack.t1574.002
    - attack.t1112
fields:
    - EventID
    - CommandLine
    - ParentCommandLine
    - Image
    - User
    - TargetObject
falsepositives:
    - unknown
level: high
---
logsource:
    product: windows
    category: registry_event
detection:
    dnsregmod: 
        TargetObject|endswith: '\services\DNS\Parameters\ServerLevelPluginDll'
    condition: 1 of them
---
logsource:
    category: process_creation
    product: windows
detection:
    dnsadmin:
        Image|endswith: '\dnscmd.exe'
        CommandLine|contains|all: 
            - '/config'
            - '/serverlevelplugindll'
    condition: 1 of them