Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for THREAT-Recon-DNSZoneTransferReconAttempt.
Upgrade to ProDetect Unauthorized DNS Zone Transfer (AXFR) and Bulk Record Enumeration Against Authoritative Nameservers in IBM QRadar
Adversaries scoping an external attack surface frequently target the victim's authoritative nameservers directly, attempting a full DNS zone transfer (AXFR, and its incremental sibling IXFR) in the hope of finding a misconfigured 'allow-transfer any' ACL. A successful AXFR dumps every record in the zone in one response — internal hostnames, mail server (MX) and SPF/DKIM/DMARC TXT records revealing third-party SaaS relationships, service discovery (SRV) records, and sometimes internal IP addressing exposed through stale A/PTR entries — handing the adversary a ready-made map of the organization's external and semi-external footprint without a single port scan. When the transfer is refused (the common case on a correctly configured server), adversaries and OSINT/recon tooling such as dnsrecon, fierce, dnsenum, and dig-based scripts fall back to bulk enumeration: rapid, scripted queries across many record types (NS, MX, TXT, SOA, ANY) and many candidate subdomains against the authoritative server itself, rather than a passive third-party database. This detection targets that server-side behavioral signature — AXFR/IXFR requests and abnormal query-type/query-name diversity from a single external client hitting the authoritative nameserver in a short window — as observed in the nameserver's own query and transfer logs, distinct from the OSINT-tool-execution coverage on the T1590.002 technique page, which keys on endpoint process telemetry for the same tools rather than the server-side query pattern. Sandworm Team, APT41, and Magic Hound have all been documented conducting broad DNS and network-infrastructure reconnaissance ahead of infrastructure acquisition and initial-access operations, and the same fingerprint is produced just as often by legitimate DNS hygiene audits, misconfiguration scanners, and unauthorized red-team activity.
MITRE ATT&CK
- Tactic
- Reconnaissance
QRadar Detection Query
SELECT
UTF8(sourceip) AS ClientIP,
COUNT(*) AS TotalQueries,
SUM(CASE WHEN "DNS Query Type" IN ('AXFR', 'IXFR', '252', '251') THEN 1 ELSE 0 END) AS ZoneTransferAttempts,
UNIQUECOUNT("DNS Query Type") AS UniqueQueryTypes,
UNIQUECOUNT("DNS Query Name") AS UniqueQueryNames
FROM events
WHERE LOGSOURCETYPENAME(logsourceid) IN ('Microsoft DNS Server', 'Infoblox NIOS', 'BIND DNS Server')
AND starttime > NOW() - 3600000
GROUP BY ClientIP
HAVING SUM(CASE WHEN "DNS Query Type" IN ('AXFR', 'IXFR', '252', '251') THEN 1 ELSE 0 END) > 0
OR (COUNT(*) >= 30 AND UNIQUECOUNT("DNS Query Type") >= 4)
ORDER BY ZoneTransferAttempts DESC, TotalQueries DESCQRadar AQL query aggregating authoritative-nameserver query events by client IP over a 1-hour window, using a CASE-based conditional sum to flag AXFR/IXFR zone-transfer attempts and a GROUP BY/HAVING clause to surface the bulk multi-type enumeration branch — the same zone-transfer/bulk-enumeration logic as the KQL/SPL versions, expressed over QRadar's normalized DNS Query Type and DNS Query Name custom event properties (requires a DSM or Universal LEEF mapping extracting these fields from Windows DNS Server, Infoblox, or BIND logs).
Data Sources
Required Tables
False Positives & Tuning
- Legitimate secondary/slave nameserver replication from documented secondary NS IPs — build a QRadar reference set of authorized transfer sources and exclude them from ClientIP
- Managed DNS or anycast providers pulling zone data via scheduled AXFR from a documented set of provider IPs
- Authorized penetration testing or DNS hygiene audits explicitly scoped to probe zone-transfer misconfiguration
Other platforms for THREAT-Recon-DNSZoneTransferReconAttempt
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate External AXFR Zone Transfer Attempt via dig
Expected signal: DNS server query/transfer log entry showing a TCP/53 session and an AXFR-type request for df00tech-zonetransfer-test.internal from the test host; if no authoritative nameserver is listening on 127.0.0.1 the request fails immediately, but the outbound TCP/53 attempt and (on a lab BIND/Windows DNS instance) the query log entry are still generated for detection validation.
- Test 2Simulate Bulk Multi-Type DNS Record Enumeration via Scripted dig Loop
Expected signal: DNS server query log records approximately 40 queries from the test host spanning 8 distinct query types (NS/MX/TXT/SOA/A/AAAA/CNAME/SRV) and 5 distinct subdomain names within a short window.
- Test 3Simulate Bulk ANY-Type Query Sweep via nslookup on Windows
Expected signal: Windows DNS Server analytic log / DnsEvents entries for 12 ANY-type queries from the test host against 12 distinct subdomain names within a short window, ingested via Azure Monitor Agent.
References (7)
Unlock playbooks & atomic tests with Pro
Get the full detection package for THREAT-Recon-DNSZoneTransferReconAttempt — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month