Detect DNS Server in Google Chronicle
Adversaries may compromise third-party DNS servers to support operations. By gaining control over DNS infrastructure, adversaries can alter DNS records to redirect organizational traffic, facilitate credential harvesting, or redirect users to adversary-controlled infrastructure mimicking legitimate services. This technique is used by threat actors including Sea Turtle and LAPSUS$, who modified NS records and DNS configurations to intercept traffic at scale. Unlike acquiring new DNS infrastructure (T1583.002), this involves compromising existing, trusted DNS servers — making detection harder due to the perceived legitimacy of the infrastructure.
MITRE ATT&CK
- Tactic
- Resource Development
- Technique
- T1584 Compromise Infrastructure
- Sub-technique
- T1584.002 DNS Server
- Canonical reference
- https://attack.mitre.org/techniques/T1584/002/
YARA-L Detection Query
rule t1584_002_dns_server_compromise {
meta:
author = "Argus Detection Engineering"
description = "Detects T1584.002 - DNS Server compromise via rogue DNS queries or DNS registry configuration changes"
mitre_attack_tactic = "Resource Development"
mitre_attack_technique = "T1584.002"
mitre_attack_url = "https://attack.mitre.org/techniques/T1584/002/"
severity = "HIGH"
confidence = "MEDIUM"
priority = "HIGH"
events:
// Signal 1: Network connections to port 53 targeting non-authorized DNS resolvers
$net.metadata.event_type = "NETWORK_CONNECTION"
$net.target.port = 53
not $net.target.ip = "8.8.8.8"
not $net.target.ip = "8.8.4.4"
not $net.target.ip = "1.1.1.1"
not $net.target.ip = "1.0.0.1"
not $net.target.ip = "9.9.9.9"
not re.regex($net.target.ip, `^10\.`)
not re.regex($net.target.ip, `^172\.(1[6-9]|2[0-9]|3[01])\.`)
not re.regex($net.target.ip, `^192\.168\.`)
not re.regex($net.target.ip, `^127\.`)
// Signal 2: Registry modifications to Windows TCP/IP DNS configuration keys
$reg.metadata.event_type = "REGISTRY_MODIFICATION"
re.regex($reg.target.registry_key, `(?i).*\\Services\\Tcpip\\Parameters.*`)
re.regex($reg.target.registry_value_name, `(?i)^(NameServer|DhcpNameServer|SearchList|DhcpDomain)$`)
condition:
$net or $reg
}Chronicle YARA-L 2.0 detection rule for T1584.002 using two independent UDM event variables. $net matches NETWORK_CONNECTION events on port 53 to public IPs not in the authorized resolver set. $reg matches REGISTRY_MODIFICATION events targeting TCP/IP DNS configuration value names under the Tcpip\Parameters key tree. Either variable independently satisfies the condition, enabling detection of both attack vectors from a single rule with no sequence join requirement.
Data Sources
Required Tables
False Positives & Tuning
- Organizations using public DNS resolvers beyond the five hardcoded IPs in the rule (e.g., Cloudflare for Teams 162.159.36.1, Quad9 variants 9.9.9.10/9.9.9.11, or ISP-assigned resolvers) will see high false-positive rates — the not $net.target.ip exclusions must be extended to cover all sanctioned resolvers before enabling alerting
- Legitimate DHCP-driven DNS updates where the Windows DHCP client service (svchost.exe hosting Dhcp) writes DhcpNameServer and DhcpDomain values during normal lease acquisition; Chronicle UDM enrichment from the process context can help differentiate by checking principal.process.file.full_path
- Remote IT management platforms (Ansible, SCCM, Tanium) executing DNS configuration remediation workflows that write NameServer values to Tcpip\Parameters\Interfaces as part of authorized remediation playbooks — suppression by principal.hostname patterns matching known management jump servers may be required
Other platforms for T1584.002
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Configure Rogue DNS Server via Registry
Expected signal: Sysmon Event ID 13 (Registry Value Set): TargetObject containing 'Tcpip\Parameters\Interfaces' and RegistryValueName 'NameServer', with Details '127.0.0.1', Image=reg.exe. Security Event ID 4657 (if object access auditing is enabled for registry). The initiating process reg.exe is unusual for a NameServer modification — legitimate changes come from svchost.exe (DHCP client).
- Test 2Direct DNS Query to Rogue Resolver
Expected signal: Sysmon Event ID 3 (Network Connection): DestinationIp=8.8.8.8, DestinationPort=53, Image=nslookup.exe. Sysmon Event ID 22 (DNS Query): QueryName=microsoft.com, Image=nslookup.exe. If 8.8.8.8 is not in the authorized DNS list, the DeviceNetworkEvents alert fires.
- Test 3Modify DNS Server via PowerShell
Expected signal: Sysmon Event ID 1 (Process Create): Image=powershell.exe, CommandLine containing 'Set-DnsClientServerAddress' and 'ServerAddresses'. Sysmon Event ID 13 (Registry Value Set): TargetObject under Tcpip\Parameters\Interfaces with NameServer value changed, Image=powershell.exe. PowerShell ScriptBlock Logging Event ID 4104 with full command content.
- Test 4DNS Query to Multiple Non-Authorized Resolvers
Expected signal: Three separate Sysmon Event ID 3 (Network Connection) events: DestinationPort=53 to 8.8.8.8, 1.1.1.1, and 9.9.9.9 respectively, Image=nslookup.exe. Three Sysmon Event ID 22 (DNS Query) events for example.com. Sysmon Event ID 1 for cmd.exe and nslookup.exe process creations.
References (11)
- https://attack.mitre.org/techniques/T1584/002/
- https://www.fireeye.com/blog/threat-research/2019/01/global-dns-hijacking-campaign-dns-record-manipulation-at-scale.html
- https://www.crowdstrike.com/blog/widespread-dns-hijacking-activity-targets-multiple-sectors/
- https://blog.talosintelligence.com/2018/11/dnspionage-campaign-targets-middle-east.html
- https://blog.talosintelligence.com/2019/04/seaturtle.html
- https://blogs.cisco.com/security/talos/angler-domain-shadowing
- https://www.proofpoint.com/us/threat-insight/post/The-Shadow-Knows
- https://cybercx.com.au/blog/keys-to-the-saas-kingdom/
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-devicenetworkevents-table
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-deviceregistryevents-table
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1584.002/T1584.002.md
Unlock Pro Content
Get the full detection package for T1584.002 including response playbook, investigation guide, and atomic red team tests.