Detect DNS Server in Splunk
Adversaries may compromise third-party DNS servers to support operations. By gaining control over DNS infrastructure, adversaries can alter DNS records to redirect organizational traffic, facilitate credential harvesting, or redirect users to adversary-controlled infrastructure mimicking legitimate services. This technique is used by threat actors including Sea Turtle and LAPSUS$, who modified NS records and DNS configurations to intercept traffic at scale. Unlike acquiring new DNS infrastructure (T1583.002), this involves compromising existing, trusted DNS servers — making detection harder due to the perceived legitimacy of the infrastructure.
MITRE ATT&CK
- Tactic
- Resource Development
- Technique
- T1584 Compromise Infrastructure
- Sub-technique
- T1584.002 DNS Server
- Canonical reference
- https://attack.mitre.org/techniques/T1584/002/
SPL Detection Query
| union
[
search index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=3
DestinationPort=53 NOT (DestinationIp="10.*" OR DestinationIp="172.16.*" OR DestinationIp="192.168.*" OR DestinationIp="127.*")
| eval QueryType="Network"
| eval DNS_Target=DestinationIp
| eval ProcessName=Image
| eval CommandLine=CommandLine
| eval Indicator="Rogue DNS Query Port 53"
| table _time, host, User, ProcessName, CommandLine, DNS_Target, Indicator
],
[
search index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=13
TargetObject="*\\Services\\Tcpip\\Parameters*"
(TargetObject="*NameServer*" OR TargetObject="*DhcpNameServer*" OR TargetObject="*SearchList*")
| eval Indicator="DNS Registry Config Changed"
| eval DNS_Target=Details
| eval ProcessName=Image
| table _time, host, User, ProcessName, TargetObject, DNS_Target, Indicator
],
[
search index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=22
| eval DNS_Target=QueryName
| rex field=QueryResults "(?<ResolvedIP>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"
| where isnotnull(ResolvedIP)
| eval Indicator="DNS Query Resolved"
| eval ProcessName=Image
| table _time, host, User, ProcessName, DNS_Target, ResolvedIP, QueryResults, Indicator
]
| eval RogueServer=if(Indicator="Rogue DNS Query Port 53", 1, 0)
| eval ConfigChange=if(Indicator="DNS Registry Config Changed", 1, 0)
| eval SuspicionScore=RogueServer + ConfigChange
| sort - _time
| table _time, host, User, ProcessName, DNS_Target, Indicator, RogueServer, ConfigChange, SuspicionScoreThree-branch detection using Sysmon telemetry. Branch 1 uses Event ID 3 (Network Connection) to identify processes initiating DNS queries to port 53 on public non-RFC1918 IPs not in the authorized resolver list. Branch 2 uses Event ID 13 (Registry Value Set) to catch modifications to DNS configuration registry keys under HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters, which adversaries change to redirect DNS to compromised servers. Branch 3 uses Event ID 22 (DNS Query) to log all DNS resolutions with their responses for baseline analysis and anomaly hunting. Suspicion scoring prioritizes events with multiple concurrent indicators.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Developers or power users manually configuring alternative DNS resolvers (Cloudflare, Google) on their workstations
- VPN software legitimately modifying DhcpNameServer registry values when establishing tunnels
- DHCP renewals that update NameServer registry values through normal Windows networking stack behavior
- Docker Desktop and WSL2 creating virtual DNS entries in registry for their internal virtual network adapters
- IT administration tools (PDQ Deploy, SCCM) that push DNS configuration changes as part of network hardening policies
Other platforms for T1584.002
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Configure Rogue DNS Server via Registry
Expected signal: Sysmon Event ID 13 (Registry Value Set): TargetObject containing 'Tcpip\Parameters\Interfaces' and RegistryValueName 'NameServer', with Details '127.0.0.1', Image=reg.exe. Security Event ID 4657 (if object access auditing is enabled for registry). The initiating process reg.exe is unusual for a NameServer modification — legitimate changes come from svchost.exe (DHCP client).
- Test 2Direct DNS Query to Rogue Resolver
Expected signal: Sysmon Event ID 3 (Network Connection): DestinationIp=8.8.8.8, DestinationPort=53, Image=nslookup.exe. Sysmon Event ID 22 (DNS Query): QueryName=microsoft.com, Image=nslookup.exe. If 8.8.8.8 is not in the authorized DNS list, the DeviceNetworkEvents alert fires.
- Test 3Modify DNS Server via PowerShell
Expected signal: Sysmon Event ID 1 (Process Create): Image=powershell.exe, CommandLine containing 'Set-DnsClientServerAddress' and 'ServerAddresses'. Sysmon Event ID 13 (Registry Value Set): TargetObject under Tcpip\Parameters\Interfaces with NameServer value changed, Image=powershell.exe. PowerShell ScriptBlock Logging Event ID 4104 with full command content.
- Test 4DNS Query to Multiple Non-Authorized Resolvers
Expected signal: Three separate Sysmon Event ID 3 (Network Connection) events: DestinationPort=53 to 8.8.8.8, 1.1.1.1, and 9.9.9.9 respectively, Image=nslookup.exe. Three Sysmon Event ID 22 (DNS Query) events for example.com. Sysmon Event ID 1 for cmd.exe and nslookup.exe process creations.
References (11)
- https://attack.mitre.org/techniques/T1584/002/
- https://www.fireeye.com/blog/threat-research/2019/01/global-dns-hijacking-campaign-dns-record-manipulation-at-scale.html
- https://www.crowdstrike.com/blog/widespread-dns-hijacking-activity-targets-multiple-sectors/
- https://blog.talosintelligence.com/2018/11/dnspionage-campaign-targets-middle-east.html
- https://blog.talosintelligence.com/2019/04/seaturtle.html
- https://blogs.cisco.com/security/talos/angler-domain-shadowing
- https://www.proofpoint.com/us/threat-insight/post/The-Shadow-Knows
- https://cybercx.com.au/blog/keys-to-the-saas-kingdom/
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-devicenetworkevents-table
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-deviceregistryevents-table
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1584.002/T1584.002.md
Unlock Pro Content
Get the full detection package for T1584.002 including response playbook, investigation guide, and atomic red team tests.