Which SIEM platforms have a THREAT-Recon-DNSSubdomainWordlistEnumeration detection rule?

df00tech provides THREAT-Recon-DNSSubdomainWordlistEnumeration (DNS Subdomain Wordlist Brute-Force Enumeration) detection queries for 7 SIEM platforms: Microsoft Sentinel / Defender, Splunk, Elastic Security (EQL), IBM QRadar (AQL), Sumo Logic CSE, Google Chronicle / SecOps, CrowdStrike LogScale (CQL).

What severity and confidence is the THREAT-Recon-DNSSubdomainWordlistEnumeration detection?

The THREAT-Recon-DNSSubdomainWordlistEnumeration detection is rated medium severity with medium confidence.

What are common false positives for THREAT-Recon-DNSSubdomainWordlistEnumeration?

Common false positives for THREAT-Recon-DNSSubdomainWordlistEnumeration include: Authorized attack-surface management or external ASM vendors (e.g., contracted bug bounty platforms) running scheduled subdomain discovery scans from documented IP ranges; Internal DNS infrastructure teams or DevOps performing zone audits, cache-warming scripts, or DNS migration validation that queries many candidate hostnames in sequence; Approved penetration testing or red team engagements actively enumerating the DNS namespace during the engagement window.

Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for THREAT-Recon-DNSSubdomainWordlistEnumeration.

Upgrade to Pro

THREAT-Recon-DNSSubdomainWordlistEnumeration

DNS Subdomain Wordlist Brute-Force Enumeration

Q: What data sources are required to detect DNS Subdomain Wordlist Brute-Force Enumeration (THREAT-Recon-DNSSubdomainWordlistEnumeration)?

Detecting DNS Subdomain Wordlist Brute-Force Enumeration requires the following data sources: Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation, CommonSecurityLog (authoritative/recursive DNS query logs via CEF/syslog), Microsoft Defender for Endpoint DeviceProcessEvents.

Reconnaissance Last updated: July 21, 2026

Adversaries iteratively query an organization's authoritative or recursive DNS infrastructure with large wordlists of candidate subdomain labels (dev, staging, vpn, mail-old, api-internal, etc.) to discover hostnames that were never intentionally published — forgotten staging environments, internal-only services accidentally exposed, or third-party integrations. Unlike the HTTP directory/file wordlist scanning covered by generic Active Scanning detections, this technique operates entirely at the DNS layer using tools such as massdns, puredns, gobuster's dns mode, dnsrecon, fierce, and amass's active enumeration mode, which resolve thousands of candidate FQDNs per minute and rely on the high NXDOMAIN response rate as an intrinsic side effect of brute-forcing an unknown namespace. Because these queries never touch a web server or generate an HTTP log line, they are invisible to WAF- and web-access-log-based scanning detections and require dedicated visibility into DNS server query logs (authoritative nameserver, recursive resolver, or DNS security gateway) plus endpoint process telemetry for internal pivot scanning.

What is THREAT-Recon-DNSSubdomainWordlistEnumeration DNS Subdomain Wordlist Brute-Force Enumeration?

DNS Subdomain Wordlist Brute-Force Enumeration (THREAT-Recon-DNSSubdomainWordlistEnumeration) maps to the Reconnaissance tactic — the adversary is trying to gather information they can use to plan future operations in MITRE ATT&CK.

This page provides production-ready detection logic for DNS Subdomain Wordlist Brute-Force Enumeration, covering the data sources and telemetry it touches: Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation, CommonSecurityLog (authoritative/recursive DNS query logs via CEF/syslog), Microsoft Defender for Endpoint DeviceProcessEvents. The queries below are rated medium severity at medium confidence, and ship for 7 SIEM platforms — KQL, SPL, Elastic, QRadar, Sumo, YARA-L, LogScale.

MITRE ATT&CK

Tactic: Reconnaissance

Microsoft Sentinel / Defender

kusto

let SubdomainWordlistTools = dynamic([
    "massdns", "gobuster", "puredns", "dnsrecon", "fierce", "amass",
    "dnsx", "altdns", "dnscan", "subbrute", "assetfinder"
]);
// Branch 1: Authoritative/recursive DNS server query logs (BIND, PowerDNS, Unbound, Infoblox via syslog/CEF)
let DNSWordlistBruteforce =
    CommonSecurityLog
    | where TimeGenerated > ago(24h)
    | where DeviceEventClassID has_any ("dns", "query") or Activity has_any ("DNS Query", "Query")
    | where Message has "NXDOMAIN" or AdditionalExtensions has "NXDOMAIN"
    | extend QueriedFQDN = extract(@"query:\s*([a-zA-Z0-9\-\.]+)", 1, Message)
    | where isnotempty(QueriedFQDN)
    | extend BaseDomain = extract(@"([a-zA-Z0-9\-]+\.[a-zA-Z]{2,})$", 1, QueriedFQDN)
    | summarize
        NXDomainCount = count(),
        UniqueSubdomains = dcount(QueriedFQDN),
        UniqueBaseDomains = dcount(BaseDomain),
        SampleSubdomains = make_set(QueriedFQDN, 20),
        FirstQuery = min(TimeGenerated),
        LastQuery = max(TimeGenerated)
      by SourceIP, BaseDomain, DeviceVendor, DeviceProduct
    | where UniqueSubdomains >= 50 and NXDomainCount >= 50
    | extend
        DetectionBranch = "DNSServerQueryLog",
        ScanDurationMinutes = datetime_diff('minute', LastQuery, FirstQuery),
        QueryRatePerMinute = round(toreal(NXDomainCount) / iff(datetime_diff('minute', LastQuery, FirstQuery) > 0, datetime_diff('minute', LastQuery, FirstQuery), 1), 1)
    | project FirstQuery, LastQuery, ScanDurationMinutes, SourceIP, BaseDomain,
        NXDomainCount, UniqueSubdomains, QueryRatePerMinute, SampleSubdomains,
        DeviceVendor, DeviceProduct, DetectionBranch;
// Branch 2: Internal endpoint executing DNS subdomain wordlist/brute-force tooling
let InternalToolExecution =
    DeviceProcessEvents
    | where Timestamp > ago(24h)
    | where FileName has_any (SubdomainWordlistTools)
        or ProcessCommandLine has_any (
            "massdns -r", "gobuster dns", "puredns bruteforce", "dnsrecon -D",
            "fierce --domain", "amass enum -active", "dnsx -d", "altdns -i")
    | summarize
        AlertCount = count(),
        Commands = make_set(ProcessCommandLine, 5),
        Tools = make_set(FileName, 10),
        FirstSeen = min(Timestamp),
        LastSeen = max(Timestamp)
      by AccountName, DeviceName, FileName
    | extend
        DetectionBranch = "InternalDNSEnumTool",
        SourceIP = DeviceName,
        BaseDomain = "internal-pivot",
        NXDomainCount = AlertCount,
        UniqueSubdomains = AlertCount,
        QueryRatePerMinute = 0.0,
        SampleSubdomains = Commands,
        DeviceVendor = "MicrosoftDefenderEndpoint",
        DeviceProduct = FileName,
        ScanDurationMinutes = datetime_diff('minute', LastSeen, FirstSeen)
    | project FirstQuery = FirstSeen, LastQuery = LastSeen, ScanDurationMinutes, SourceIP, BaseDomain,
        NXDomainCount, UniqueSubdomains, QueryRatePerMinute, SampleSubdomains,
        DeviceVendor, DeviceProduct, DetectionBranch;
DNSWordlistBruteforce
| union InternalToolExecution
| sort by NXDomainCount desc

Detects DNS subdomain wordlist brute-forcing through two complementary branches. Branch 1 queries CommonSecurityLog for CEF-normalized DNS server query events (authoritative nameserver, recursive resolver, or DNS security gateway such as Infoblox) and flags source IPs generating a high volume of NXDOMAIN responses across many distinct subdomains of the same base domain within a rolling window — the intrinsic signature of brute-forcing an unknown DNS namespace with a wordlist. Branch 2 queries DeviceProcessEvents for execution of named DNS subdomain enumeration tools (massdns, gobuster dns mode, puredns, dnsrecon, fierce, amass active mode, dnsx, altdns) on monitored endpoints, covering internal pivot scanning or red team activity. Results are unioned for a unified triage view across both the DNS-server and endpoint-process detection surfaces.

medium severity medium confidence

Data Sources

Network Traffic: Network Traffic Content Network Traffic: Network Traffic Flow Process: Process Creation CommonSecurityLog (authoritative/recursive DNS query logs via CEF/syslog) Microsoft Defender for Endpoint DeviceProcessEvents

Required Tables

CommonSecurityLog DeviceProcessEvents

False Positives

Authorized attack-surface management or external ASM vendors (e.g., contracted bug bounty platforms) running scheduled subdomain discovery scans from documented IP ranges
Internal DNS infrastructure teams or DevOps performing zone audits, cache-warming scripts, or DNS migration validation that queries many candidate hostnames in sequence
Approved penetration testing or red team engagements actively enumerating the DNS namespace during the engagement window
Certificate transparency monitoring or subdomain-discovery SaaS tooling that resolves large candidate lists to validate live hosts before issuing scan reports
Misconfigured internal applications or scripts performing rapid repeated DNS lookups against a typo'd or deprecated base domain (self-inflicted NXDOMAIN storms, not adversarial)

Splunk

spl

| union
[
  search index=dns sourcetype IN ("bind:query", "infoblox:dns", "powerdns", "unbound")
      NXDOMAIN
  | rex field=_raw "query:\s*(?<queried_fqdn>[a-zA-Z0-9\-\.]+)"
  | rex field=queried_fqdn "(?<base_domain>[a-zA-Z0-9\-]+\.[a-zA-Z]{2,}$)"
  | stats
      count as nxdomain_count,
      dc(queried_fqdn) as unique_subdomains,
      values(queried_fqdn) as sample_subdomains,
      min(_time) as first_query,
      max(_time) as last_query
      by src_ip, base_domain
  | where unique_subdomains >= 50 AND nxdomain_count >= 50
  | eval scan_duration_minutes=round((last_query - first_query) / 60, 1)
  | eval detection_branch="DNSServerQueryLog"
  | eval query_rate_per_minute=round(nxdomain_count / max(scan_duration_minutes, 1), 1)
]
[
  search index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
      (Image="*\\massdns*" OR Image="*\\gobuster.exe" OR Image="*\\puredns*" OR Image="*\\dnsrecon*"
       OR Image="*\\fierce*" OR Image="*\\amass.exe" OR Image="*\\dnsx.exe" OR Image="*\\altdns*"
       OR CommandLine="*gobuster dns*" OR CommandLine="*puredns bruteforce*" OR CommandLine="*amass enum -active*"
       OR CommandLine="*massdns -r*" OR CommandLine="*dnsrecon -D*")
  | eval detection_branch="InternalDNSEnumTool"
  | eval src_ip=host
  | eval base_domain="internal-pivot"
  | eval query_rate_per_minute=0
  | stats
      count as nxdomain_count,
      dc(Image) as unique_subdomains,
      values(CommandLine) as sample_subdomains,
      min(_time) as first_query,
      max(_time) as last_query
      by src_ip, detection_branch, User, base_domain, query_rate_per_minute
  | eval scan_duration_minutes=round((last_query - first_query) / 60, 1)
]
| table first_query, last_query, scan_duration_minutes, src_ip, base_domain,
         nxdomain_count, unique_subdomains, query_rate_per_minute, sample_subdomains, detection_branch
| sort - nxdomain_count

Detects DNS subdomain wordlist brute-forcing using Splunk. The first branch searches DNS server query log sourcetypes (BIND, Infoblox, PowerDNS, Unbound) for NXDOMAIN responses, aggregating by source IP and base domain to surface high-volume, high-cardinality subdomain query bursts consistent with wordlist brute-forcing. The second branch searches Sysmon Event ID 1 (Process Creation) for known DNS subdomain enumeration tool executables and command-line patterns on Windows endpoints, covering massdns, gobuster dns mode, puredns, dnsrecon, fierce, amass, dnsx, and altdns. Both branches report unified fields for analyst triage.

medium severity medium confidence

Data Sources

Network Traffic: Network Traffic Content DNS Server Query Logs (BIND, PowerDNS, Unbound, Infoblox) Process: Process Creation Sysmon Event ID 1

Required Sourcetypes

bind:query infoblox:dns powerdns unbound XmlWinEventLog:Microsoft-Windows-Sysmon/Operational

False Positives

Authorized attack-surface management vendors or bug bounty platforms running scheduled subdomain discovery scans from documented IP ranges
Internal DNS/DevOps teams performing zone audits or DNS migration validation that resolves many candidate hostnames in sequence
Approved penetration testing or red team engagements actively enumerating the DNS namespace during the engagement window
Certificate transparency or subdomain-discovery SaaS tooling resolving large candidate lists to validate live hosts
Misconfigured internal scripts generating self-inflicted NXDOMAIN storms against a typo'd or deprecated base domain

IBM QRadar (AQL)

sql

SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS EventTime,
  sourceip AS SourceIP,
  destinationip AS DestinationIP,
  username AS Username,
  "Process Name" AS ProcessName,
  "Command" AS CommandLine,
  CASE
    WHEN LOWER("Process Name") LIKE '%massdns%' OR LOWER("Process Name") LIKE '%gobuster%'
      OR LOWER("Process Name") LIKE '%puredns%' OR LOWER("Process Name") LIKE '%dnsrecon%'
      OR LOWER("Process Name") LIKE '%amass%' THEN 'InternalDNSEnumTool'
    ELSE 'Other'
  END AS Signal
FROM events
WHERE
  QIDNAME(qid) LIKE '%Process Create%'
  AND (
    LOWER("Process Name") LIKE '%massdns%'
    OR LOWER("Process Name") LIKE '%gobuster%'
    OR LOWER("Process Name") LIKE '%puredns%'
    OR LOWER("Process Name") LIKE '%dnsrecon%'
    OR LOWER("Process Name") LIKE '%amass%'
  )
  AND starttime > NOW() - 86400000
UNION
SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS EventTime,
  sourceip AS SourceIP,
  'N/A' AS DestinationIP,
  'N/A' AS Username,
  'N/A' AS ProcessName,
  QUERYNAME AS CommandLine,
  'DNSServerQueryLog' AS Signal
FROM dns_events
WHERE
  RESPONSECODE = 'NXDOMAIN'
  AND starttime > NOW() - 86400000
GROUP BY sourceip, QUERYNAME
HAVING COUNT(*) OVER (PARTITION BY sourceip) >= 50
ORDER BY EventTime DESC

QRadar AQL detection combining process-based events (execution of massdns, gobuster, puredns, dnsrecon, or amass) with a UNION over a DNS query log source filtered to NXDOMAIN responses, surfacing source IPs generating high-volume subdomain enumeration traffic against the authoritative or recursive DNS layer.

medium severity medium confidence

Data Sources

IBM QRadar SIEM Windows Security/Sysmon Event Log (process creation) QRadar DNS Log Source (authoritative/recursive DNS query events)

Required Tables

events dns_events

False Positives

Network operations or ASM vendors running scheduled subdomain discovery scans against documented base domains
Legitimate DNS migration or zone-audit scripts resolving many candidate hostnames in sequence

Sigma rule & cross-platform mapping

The detection logic for DNS Subdomain Wordlist Brute-Force Enumeration (THREAT-Recon-DNSSubdomainWordlistEnumeration) above is provided in a vendor-neutral form so you can deploy it on any SIEM. The same logic is shipped here as native KQL (Microsoft Sentinel / Defender), SPL (Splunk), Elastic (Elastic Security (EQL)), QRadar (IBM QRadar (AQL)), Sumo (Sumo Logic CSE), YARA-L (Google Chronicle / SecOps), LogScale (CrowdStrike LogScale (CQL)) queries. In Sigma terms, this detection targets the following logsource:

logsource:
  category: process_creation
  product: windows

Browse the community-maintained Sigma rules for this technique:

SigmaHQ rules for THREAT-Recon-DNSSubdomainWordlistEnumeration Sigma rules on detection.fyi

Platform-specific guides for THREAT-Recon-DNSSubdomainWordlistEnumeration

Detect in Microsoft Sentinel (KQL) Detect in Splunk (SPL) Detect in Elastic Security (Elastic) Detect in IBM QRadar (QRadar) Detect in Sumo Logic CSE (Sumo) Detect in Google Chronicle (YARA-L) Detect in CrowdStrike LogScale (LogScale)

Last updated: 2026-07-21 Research depth: deep

References (5)

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

Test 1Simulated DNS Subdomain Wordlist Query Burst
Expected signal: Authoritative/recursive DNS server query log entries showing 60 sequential NXDOMAIN responses for distinct subdomains of example.com from the executing host's source IP within a short window.
Test 2gobuster DNS Mode Execution
Expected signal: Process creation event for gobuster with CommandLine containing 'dns -d example.com -w' and the wordlist file path.
Test 3massdns Bulk Subdomain Resolution
Expected signal: Process creation event for massdns with CommandLine containing '-r' and '-t A' flags; DNS query log entries for the listed candidate subdomains.

Response Playbook

1. Examine the full command line and decode any Base64 content...
2. Identify the parent process chain and user context...
3. Check for concurrent network connections from the process...

Investigation Guide

Related techniques: T1027, T1105, T1562.001...
Forensic artifacts: PSReadLine history, Prefetch, ScriptBlock logs...

Atomic Red Team Tests

Test 1: Encoded command execution...
Test 2: Download cradle via Net.WebClient...

Unlock playbooks & atomic tests with Pro

Get the full detection package for THREAT-Recon-DNSSubdomainWordlistEnumeration — response playbook and atomic red team tests, plus investigation guidance and hunting queries.

df00tech Pro — £29/user/month

Response PlaybookInvestigation GuideHunting QueriesAtomic Red Team TestsTuning Guidance

Related Detections

DNS Subdomain Wordlist Brute-Force Enumeration

What is THREAT-Recon-DNSSubdomainWordlistEnumeration DNS Subdomain Wordlist Brute-Force Enumeration?

MITRE ATT&CK

Data Sources

Required Tables

False Positives

Data Sources

Required Sourcetypes

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Sigma rule & cross-platform mapping

Platform-specific guides for THREAT-Recon-DNSSubdomainWordlistEnumeration

Testing Methodology

Response Playbook

Investigation Guide

Atomic Red Team Tests

Unlock playbooks & atomic tests with Pro

Related Detections

Tactic Hub

Parent Technique

Related Techniques

Same Tactic: Reconnaissance

Popular Detections

What is THREAT-Recon-DNSSubdomainWordlistEnumeration DNS Subdomain Wordlist Brute-Force Enumeration?

MITRE ATT&CK

Data Sources

Required Tables

False Positives

Data Sources

Required Sourcetypes

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Sigma rule & cross-platform mapping

Platform-specific guides for THREAT-Recon-DNSSubdomainWordlistEnumeration

Testing Methodology

Unlock playbooks & atomic tests with Pro

Related Detections

Tactic Hub

Parent Technique

Related Techniques

Same Tactic: Reconnaissance

Popular Detections

Get new detections in your inbox