Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for THREAT-Recon-DNSSubdomainWordlistEnumeration.
Upgrade to ProDetect DNS Subdomain Wordlist Brute-Force Enumeration in Splunk
Adversaries iteratively query an organization's authoritative or recursive DNS infrastructure with large wordlists of candidate subdomain labels (dev, staging, vpn, mail-old, api-internal, etc.) to discover hostnames that were never intentionally published — forgotten staging environments, internal-only services accidentally exposed, or third-party integrations. Unlike the HTTP directory/file wordlist scanning covered by generic Active Scanning detections, this technique operates entirely at the DNS layer using tools such as massdns, puredns, gobuster's dns mode, dnsrecon, fierce, and amass's active enumeration mode, which resolve thousands of candidate FQDNs per minute and rely on the high NXDOMAIN response rate as an intrinsic side effect of brute-forcing an unknown namespace. Because these queries never touch a web server or generate an HTTP log line, they are invisible to WAF- and web-access-log-based scanning detections and require dedicated visibility into DNS server query logs (authoritative nameserver, recursive resolver, or DNS security gateway) plus endpoint process telemetry for internal pivot scanning.
MITRE ATT&CK
- Tactic
- Reconnaissance
SPL Detection Query
| union
[
search index=dns sourcetype IN ("bind:query", "infoblox:dns", "powerdns", "unbound")
NXDOMAIN
| rex field=_raw "query:\s*(?<queried_fqdn>[a-zA-Z0-9\-\.]+)"
| rex field=queried_fqdn "(?<base_domain>[a-zA-Z0-9\-]+\.[a-zA-Z]{2,}$)"
| stats
count as nxdomain_count,
dc(queried_fqdn) as unique_subdomains,
values(queried_fqdn) as sample_subdomains,
min(_time) as first_query,
max(_time) as last_query
by src_ip, base_domain
| where unique_subdomains >= 50 AND nxdomain_count >= 50
| eval scan_duration_minutes=round((last_query - first_query) / 60, 1)
| eval detection_branch="DNSServerQueryLog"
| eval query_rate_per_minute=round(nxdomain_count / max(scan_duration_minutes, 1), 1)
]
[
search index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
(Image="*\\massdns*" OR Image="*\\gobuster.exe" OR Image="*\\puredns*" OR Image="*\\dnsrecon*"
OR Image="*\\fierce*" OR Image="*\\amass.exe" OR Image="*\\dnsx.exe" OR Image="*\\altdns*"
OR CommandLine="*gobuster dns*" OR CommandLine="*puredns bruteforce*" OR CommandLine="*amass enum -active*"
OR CommandLine="*massdns -r*" OR CommandLine="*dnsrecon -D*")
| eval detection_branch="InternalDNSEnumTool"
| eval src_ip=host
| eval base_domain="internal-pivot"
| eval query_rate_per_minute=0
| stats
count as nxdomain_count,
dc(Image) as unique_subdomains,
values(CommandLine) as sample_subdomains,
min(_time) as first_query,
max(_time) as last_query
by src_ip, detection_branch, User, base_domain, query_rate_per_minute
| eval scan_duration_minutes=round((last_query - first_query) / 60, 1)
]
| table first_query, last_query, scan_duration_minutes, src_ip, base_domain,
nxdomain_count, unique_subdomains, query_rate_per_minute, sample_subdomains, detection_branch
| sort - nxdomain_countDetects DNS subdomain wordlist brute-forcing using Splunk. The first branch searches DNS server query log sourcetypes (BIND, Infoblox, PowerDNS, Unbound) for NXDOMAIN responses, aggregating by source IP and base domain to surface high-volume, high-cardinality subdomain query bursts consistent with wordlist brute-forcing. The second branch searches Sysmon Event ID 1 (Process Creation) for known DNS subdomain enumeration tool executables and command-line patterns on Windows endpoints, covering massdns, gobuster dns mode, puredns, dnsrecon, fierce, amass, dnsx, and altdns. Both branches report unified fields for analyst triage.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Authorized attack-surface management vendors or bug bounty platforms running scheduled subdomain discovery scans from documented IP ranges
- Internal DNS/DevOps teams performing zone audits or DNS migration validation that resolves many candidate hostnames in sequence
- Approved penetration testing or red team engagements actively enumerating the DNS namespace during the engagement window
- Certificate transparency or subdomain-discovery SaaS tooling resolving large candidate lists to validate live hosts
- Misconfigured internal scripts generating self-inflicted NXDOMAIN storms against a typo'd or deprecated base domain
Other platforms for THREAT-Recon-DNSSubdomainWordlistEnumeration
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulated DNS Subdomain Wordlist Query Burst
Expected signal: Authoritative/recursive DNS server query log entries showing 60 sequential NXDOMAIN responses for distinct subdomains of example.com from the executing host's source IP within a short window.
- Test 2gobuster DNS Mode Execution
Expected signal: Process creation event for gobuster with CommandLine containing 'dns -d example.com -w' and the wordlist file path.
- Test 3massdns Bulk Subdomain Resolution
Expected signal: Process creation event for massdns with CommandLine containing '-r' and '-t A' flags; DNS query log entries for the listed candidate subdomains.
Unlock playbooks & atomic tests with Pro
Get the full detection package for THREAT-Recon-DNSSubdomainWordlistEnumeration — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month