Failed DNS server zone transfer for enumeration purposes

Status: experimental
Severity: medium
Log source: product windows, service dns-server
Author: mdecrevoisier
Source: github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where an attacker attempts to exploit DNS server missconfiguration to trigger a DNS zone transfer and enumerate list of valid IP and hostnames.

Known false positives

Unknwown

MITRE ATT&CK coverage

Tactic	Techniques
Discovery	`T1016` System Network Configuration Discovery

Telemetry coverage

Provider	Record / event type
DNS-Server-Service	Event ID 6004: The DNS server received a zone transfer request from param1 for a non-existent or non-authoritative zone param2.

Rule body

title: Failed DNS server zone transfer for enumeration purposes
description: Detects scenarios where an attacker attempts to exploit DNS server missconfiguration to trigger a DNS zone transfer and enumerate list of valid IP and hostnames.
references:
- https://capec.mitre.org/data/definitions/291.html
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0007-Discovery/T1016-System%20Network%20Configuration%20Discovery
- http://intelligentsystemsmonitoring.com/knowledgebase/windows-operating-system/the-dns-server-received-a-zone-transfer-request-from-for-a-nonexistent-or-nonauthoritative-zone-8319/
tags:
- attack.discovery
- attack.t1016
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  service: dns-server
detection:
  selection:
    EventID: 6004
    EventData Name: DNS_EVENT_BAD_ZONE_TRANSFER_REQUEST
  filter:
    param1: '%dns_servers%' # IP list of internal DNS servers
  condition: selection and not filter
falsepositives:
- Unknwown
level: medium

Stages and Predicates

Stage 0: `condition`

selection and not filter

Stage 1: `selection`

selection:
  EventID: 6004
  EventData Name: DNS_EVENT_BAD_ZONE_TRANSFER_REQUEST

Stage 2: `not filter`

filter:
  param1: '%dns_servers%'

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`param1`	eq	`%dns_servers%`	`excludes:param1` `field:"param1" value:"%dns_servers%"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`EventData Name`	eq	`DNS_EVENT_BAD_ZONE_TRANSFER_REQUEST`	`field:"EventData Name" kind:eq value:"DNS_EVENT_BAD_ZONE_TRANSFER_REQUEST"`