Detect Unauthorized DNS Zone Transfer (AXFR) and Bulk Record Enumeration Against Authoritative Nameservers in Elastic Security

Adversaries scoping an external attack surface frequently target the victim's authoritative nameservers directly, attempting a full DNS zone transfer (AXFR, and its incremental sibling IXFR) in the hope of finding a misconfigured 'allow-transfer any' ACL. A successful AXFR dumps every record in the zone in one response — internal hostnames, mail server (MX) and SPF/DKIM/DMARC TXT records revealing third-party SaaS relationships, service discovery (SRV) records, and sometimes internal IP addressing exposed through stale A/PTR entries — handing the adversary a ready-made map of the organization's external and semi-external footprint without a single port scan. When the transfer is refused (the common case on a correctly configured server), adversaries and OSINT/recon tooling such as dnsrecon, fierce, dnsenum, and dig-based scripts fall back to bulk enumeration: rapid, scripted queries across many record types (NS, MX, TXT, SOA, ANY) and many candidate subdomains against the authoritative server itself, rather than a passive third-party database. This detection targets that server-side behavioral signature — AXFR/IXFR requests and abnormal query-type/query-name diversity from a single external client hitting the authoritative nameserver in a short window — as observed in the nameserver's own query and transfer logs, distinct from the OSINT-tool-execution coverage on the T1590.002 technique page, which keys on endpoint process telemetry for the same tools rather than the server-side query pattern. Sandworm Team, APT41, and Magic Hound have all been documented conducting broad DNS and network-infrastructure reconnaissance ahead of infrastructure acquisition and initial-access operations, and the same fingerprint is produced just as often by legitimate DNS hygiene audits, misconfiguration scanners, and unauthorized red-team activity.