Which SIEM platforms have a T1584.002 detection rule?

df00tech provides T1584.002 (DNS Server) detection queries for 7 SIEM platforms: Microsoft Sentinel / Defender, Splunk, Elastic Security (EQL), IBM QRadar (AQL), Sumo Logic CSE, Google Chronicle / SecOps, CrowdStrike LogScale (CQL).

What data sources are required to detect DNS Server (T1584.002)?

Detecting DNS Server requires the following data sources: Network Traffic: Network Connection Creation, Windows Registry: Windows Registry Key Modification, Microsoft Defender for Endpoint.

What severity and confidence is the T1584.002 detection?

The T1584.002 detection is rated high severity with medium confidence.

What are common false positives for T1584.002?

Common false positives for T1584.002 include: Developers or researchers intentionally using alternative public DNS resolvers (1.1.1.1, 9.9.9.9, 8.8.8.8) for testing — common on developer workstations if these are not in the authorized list; VPN clients that change DNS server assignments upon connecting, particularly split-tunnel configurations that use provider DNS; DHCP lease renewals that legitimately update DhcpNameServer registry values as part of normal network operations.

T1584.002 IBM QRadar · QRadar

Detect DNS Server in IBM QRadar

Adversaries may compromise third-party DNS servers to support operations. By gaining control over DNS infrastructure, adversaries can alter DNS records to redirect organizational traffic, facilitate credential harvesting, or redirect users to adversary-controlled infrastructure mimicking legitimate services. This technique is used by threat actors including Sea Turtle and LAPSUS$, who modified NS records and DNS configurations to intercept traffic at scale. Unlike acquiring new DNS infrastructure (T1583.002), this involves compromising existing, trusted DNS servers — making detection harder due to the perceived legitimacy of the infrastructure.

MITRE ATT&CK

Tactic: Resource Development
Technique: T1584 Compromise Infrastructure
Sub-technique: T1584.002 DNS Server
Canonical reference: https://attack.mitre.org/techniques/T1584/002/

QRadar Detection Query

IBM QRadar (QRadar)

sql

SELECT
  DATEFORMAT(devicetime, 'yyyy-MM-dd HH:mm:ss') AS event_time,
  LOGSOURCENAME(logsourceid) AS log_source,
  sourceip,
  destinationip AS dns_target,
  destinationport,
  username,
  QIDNAME(qid) AS event_name,
  CATEGORYNAME(highlevelcategory) AS high_category,
  CATEGORYNAME(category) AS low_category,
  payload,
  CASE
    WHEN destinationport = 53 THEN 'Rogue DNS Server Query'
    ELSE 'DNS Registry Config Changed'
  END AS indicator
FROM events
WHERE
  starttime >= (NOW() - 86400000)
  AND
  (
    (
      destinationport = 53
      AND NOT INCIDR('10.0.0.0/8', destinationip)
      AND NOT INCIDR('172.16.0.0/12', destinationip)
      AND NOT INCIDR('192.168.0.0/16', destinationip)
      AND NOT INCIDR('127.0.0.0/8', destinationip)
      AND destinationip NOT IN ('8.8.8.8', '8.8.4.4', '1.1.1.1', '1.0.0.1', '9.9.9.9')
    )
    OR
    (
      LOGSOURCETYPENAME(devicetype) ILIKE '%Windows%'
      AND (
        payload ILIKE '%\\Services\\Tcpip\\Parameters%'
        OR payload ILIKE '%Tcpip\\Parameters\\Interfaces%'
      )
      AND (
        payload ILIKE '%NameServer%'
        OR payload ILIKE '%DhcpNameServer%'
        OR payload ILIKE '%SearchList%'
        OR payload ILIKE '%DhcpDomain%'
      )
      AND (
        QIDNAME(qid) ILIKE '%registry%'
        OR QIDNAME(qid) ILIKE '%EventID: 13%'
        OR QIDNAME(qid) ILIKE '%Sysmon%'
      )
    )
  )
ORDER BY devicetime DESC

high severity medium confidence

QRadar AQL query detecting T1584.002 by correlating network flow/event records for port 53 traffic to public non-authorized resolver IPs and Windows log source payload matches for Sysmon Event ID 13 registry value modifications to TCP/IP DNS configuration paths. Uses INCIDR for RFC1918 exclusion and ILIKE for flexible payload matching across DSM normalizations.

Data Sources

QRadar Network Activity (flows)IBM QRadar DSM for Microsoft WindowsIBM QRadar DSM for Sysmon

Required Tables

events

False Positives & Tuning

Authorized corporate DNS servers or recursive resolvers not included in the NOT IN exclusion list causing high-volume false positives across all managed endpoints — the query requires org-specific tuning to enumerate all sanctioned resolver IPs before production use
QRadar DSM payload normalization differences between Windows Security Event Log and Sysmon DSM versions may cause the payload ILIKE patterns for registry key paths to miss events depending on how raw XML is stored — validate with sample events from your specific DSM version
DHCP servers legitimately writing DhcpNameServer and DhcpDomain registry values to Windows endpoints during lease assignment; these events will match the registry branch of the OR condition and require suppression by source process (svchost.exe spawned by DHCP service)

Download portable Sigma rule (.yml)

Other platforms for T1584.002

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

Test 1Configure Rogue DNS Server via Registry
Expected signal: Sysmon Event ID 13 (Registry Value Set): TargetObject containing 'Tcpip\Parameters\Interfaces' and RegistryValueName 'NameServer', with Details '127.0.0.1', Image=reg.exe. Security Event ID 4657 (if object access auditing is enabled for registry). The initiating process reg.exe is unusual for a NameServer modification — legitimate changes come from svchost.exe (DHCP client).
Test 2Direct DNS Query to Rogue Resolver
Expected signal: Sysmon Event ID 3 (Network Connection): DestinationIp=8.8.8.8, DestinationPort=53, Image=nslookup.exe. Sysmon Event ID 22 (DNS Query): QueryName=microsoft.com, Image=nslookup.exe. If 8.8.8.8 is not in the authorized DNS list, the DeviceNetworkEvents alert fires.
Test 3Modify DNS Server via PowerShell
Expected signal: Sysmon Event ID 1 (Process Create): Image=powershell.exe, CommandLine containing 'Set-DnsClientServerAddress' and 'ServerAddresses'. Sysmon Event ID 13 (Registry Value Set): TargetObject under Tcpip\Parameters\Interfaces with NameServer value changed, Image=powershell.exe. PowerShell ScriptBlock Logging Event ID 4104 with full command content.
Test 4DNS Query to Multiple Non-Authorized Resolvers
Expected signal: Three separate Sysmon Event ID 3 (Network Connection) events: DestinationPort=53 to 8.8.8.8, 1.1.1.1, and 9.9.9.9 respectively, Image=nslookup.exe. Three Sysmon Event ID 22 (DNS Query) events for example.com. Sysmon Event ID 1 for cmd.exe and nslookup.exe process creations.

Last updated: 2026-04-13 Research depth: deep

References (11)

Response Playbook

1. Examine the full command line and decode any Base64 content...
2. Identify the parent process chain and user context...
3. Check for concurrent network connections from the process...

Investigation Guide

Related techniques: T1027, T1105, T1562.001...
Forensic artifacts: PSReadLine history, Prefetch, ScriptBlock logs...

Atomic Red Team Tests

Test 1: Encoded command execution...
Test 2: Download cradle via Net.WebClient...

Unlock Pro Content

Get the full detection package for T1584.002 including response playbook, investigation guide, and atomic red team tests.

Response PlaybookInvestigation GuideHunting QueriesAtomic Red Team TestsTuning Guidance

Detect DNS Server in IBM QRadar

MITRE ATT&CK

QRadar Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for T1584.002

Testing Methodology

Response Playbook

Investigation Guide

Atomic Red Team Tests

Unlock Pro Content

Related Detections

Parent Technique

Related Sub-techniques

Related Techniques

Same Tactic: Resource Development

Popular Detections

MITRE ATT&CK

QRadar Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for T1584.002

Testing Methodology

Unlock Pro Content

Related Detections

Parent Technique

Related Sub-techniques

Related Techniques

Same Tactic: Resource Development

Popular Detections

Get new detections in your inbox