Sunturai
Back to results
MediumSigmaHQ@gott_cyber

Potential Discovery Activity Via Dnscmd.EXE

Detects an attempt to leverage dnscmd.exe to enumerate the DNS zones of a domain. DNS zones used to host the DNS records for a particular domain.

Detection logic

Detection requirements

Log source product
windows
Log source category
process_creation

Known benign triggers

  • Legitimate administration use

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice