New DNS ServerLevelPluginDll Installed Via Dnscmd.EXE

Title: New DNS ServerLevelPluginDll Installed Via Dnscmd.EXE
Status: test
Description:Detects the installation of a DNS plugin DLL via ServerLevelPluginDll parameter in registry, which can be used to execute code in context of the DNS server (restart required)
References:
  -https://medium.com/@esnesenon/feature-not-bug-dnsadmin-to-dc-compromise-in-one-line-a0f779b8dc83
  -https://blog.3or.de/hunting-dns-server-level-plugin-dll-injection.html
Author: Florian Roth (Nextron Systems)
Date: 2017-05-08
modified:2023-02-05
Tags:

• -'attack.privilege-escalation'
• -'attack.persistence'
• -'attack.execution'
• -'attack.stealth'
• -'attack.defense-impairment'
• -'attack.t1574.001'
• -'attack.t1112'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
    Image|endswith: '\dnscmd.exe'
    CommandLine|contains|all:
      -'/config'
      -'/serverlevelplugindll'

  condition:selection
Falsepositives:
  -Unknown
Level: high