Detect DNS Server in Microsoft Sentinel
Adversaries may compromise third-party DNS servers to support operations. By gaining control over DNS infrastructure, adversaries can alter DNS records to redirect organizational traffic, facilitate credential harvesting, or redirect users to adversary-controlled infrastructure mimicking legitimate services. This technique is used by threat actors including Sea Turtle and LAPSUS$, who modified NS records and DNS configurations to intercept traffic at scale. Unlike acquiring new DNS infrastructure (T1583.002), this involves compromising existing, trusted DNS servers — making detection harder due to the perceived legitimacy of the infrastructure.
MITRE ATT&CK
- Tactic
- Resource Development
- Technique
- T1584 Compromise Infrastructure
- Sub-technique
- T1584.002 DNS Server
- Canonical reference
- https://attack.mitre.org/techniques/T1584/002/
KQL Detection Query
// Part 1: Detect endpoints querying non-authorized DNS servers (port 53 to unexpected destinations)
let AuthorizedDNSServers = dynamic(["8.8.8.8", "8.8.4.4", "1.1.1.1", "1.0.0.1", "9.9.9.9"]); // Customize with your org's DNS IPs
let InternalRanges = dynamic(["10.", "172.16.", "172.17.", "172.18.", "172.19.", "172.20.", "172.21.", "172.22.", "172.23.", "172.24.", "172.25.", "172.26.", "172.27.", "172.28.", "172.29.", "172.30.", "172.31.", "192.168."]);
DeviceNetworkEvents
| where Timestamp > ago(24h)
| where RemotePort == 53
| where RemoteIPType == "Public"
| where not(RemoteIP has_any (AuthorizedDNSServers))
| where not(LocalIP has_any (InternalRanges))
| project Timestamp, DeviceName, LocalIP, RemoteIP, RemotePort, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName
| extend Indicator = "Rogue DNS Server Query"
| union (
// Part 2: Detect DNS configuration changes via registry (changing DNS server settings)
DeviceRegistryEvents
| where Timestamp > ago(24h)
| where RegistryKey has_all ("SYSTEM", "CurrentControlSet", "Services", "Tcpip", "Parameters", "Interfaces")
| where RegistryValueName in~ ("NameServer", "DhcpNameServer", "SearchList", "DhcpDomain")
| where ActionType in~ ("RegistryValueSet", "RegistryKeyCreated")
| project Timestamp, DeviceName=DeviceName, LocalIP="", RemoteIP=RegistryCurrentValueData, RemotePort=53, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName
| extend Indicator = "DNS Configuration Changed"
)
| sort by Timestamp descTwo-part detection for DNS server compromise indicators. Part 1 identifies endpoints making DNS queries (port 53) to public IP addresses not in the authorized DNS server list — a signal that DNS settings may have been tampered with or that malware is using rogue resolvers. Part 2 monitors Windows registry paths for modifications to DNS server configuration values (NameServer, DhcpNameServer) under HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces, which adversaries modify when redirecting victims to compromised resolvers. Requires customization of AuthorizedDNSServers with your organization's actual DNS infrastructure IPs.
Data Sources
Required Tables
False Positives & Tuning
- Developers or researchers intentionally using alternative public DNS resolvers (1.1.1.1, 9.9.9.9, 8.8.8.8) for testing — common on developer workstations if these are not in the authorized list
- VPN clients that change DNS server assignments upon connecting, particularly split-tunnel configurations that use provider DNS
- DHCP lease renewals that legitimately update DhcpNameServer registry values as part of normal network operations
- Containerization platforms (Docker Desktop, WSL2) that configure their own virtual DNS resolvers pointing to non-standard IPs
- Mobile hotspot tethering or public WiFi usage where the DHCP-assigned DNS differs from corporate infrastructure
Other platforms for T1584.002
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Configure Rogue DNS Server via Registry
Expected signal: Sysmon Event ID 13 (Registry Value Set): TargetObject containing 'Tcpip\Parameters\Interfaces' and RegistryValueName 'NameServer', with Details '127.0.0.1', Image=reg.exe. Security Event ID 4657 (if object access auditing is enabled for registry). The initiating process reg.exe is unusual for a NameServer modification — legitimate changes come from svchost.exe (DHCP client).
- Test 2Direct DNS Query to Rogue Resolver
Expected signal: Sysmon Event ID 3 (Network Connection): DestinationIp=8.8.8.8, DestinationPort=53, Image=nslookup.exe. Sysmon Event ID 22 (DNS Query): QueryName=microsoft.com, Image=nslookup.exe. If 8.8.8.8 is not in the authorized DNS list, the DeviceNetworkEvents alert fires.
- Test 3Modify DNS Server via PowerShell
Expected signal: Sysmon Event ID 1 (Process Create): Image=powershell.exe, CommandLine containing 'Set-DnsClientServerAddress' and 'ServerAddresses'. Sysmon Event ID 13 (Registry Value Set): TargetObject under Tcpip\Parameters\Interfaces with NameServer value changed, Image=powershell.exe. PowerShell ScriptBlock Logging Event ID 4104 with full command content.
- Test 4DNS Query to Multiple Non-Authorized Resolvers
Expected signal: Three separate Sysmon Event ID 3 (Network Connection) events: DestinationPort=53 to 8.8.8.8, 1.1.1.1, and 9.9.9.9 respectively, Image=nslookup.exe. Three Sysmon Event ID 22 (DNS Query) events for example.com. Sysmon Event ID 1 for cmd.exe and nslookup.exe process creations.
References (11)
- https://attack.mitre.org/techniques/T1584/002/
- https://www.fireeye.com/blog/threat-research/2019/01/global-dns-hijacking-campaign-dns-record-manipulation-at-scale.html
- https://www.crowdstrike.com/blog/widespread-dns-hijacking-activity-targets-multiple-sectors/
- https://blog.talosintelligence.com/2018/11/dnspionage-campaign-targets-middle-east.html
- https://blog.talosintelligence.com/2019/04/seaturtle.html
- https://blogs.cisco.com/security/talos/angler-domain-shadowing
- https://www.proofpoint.com/us/threat-insight/post/The-Shadow-Knows
- https://cybercx.com.au/blog/keys-to-the-saas-kingdom/
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-devicenetworkevents-table
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-deviceregistryevents-table
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1584.002/T1584.002.md
Unlock Pro Content
Get the full detection package for T1584.002 including response playbook, investigation guide, and atomic red team tests.