Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for THREAT-Recon-DNSZoneTransferReconAttempt.
Upgrade to ProDetect Unauthorized DNS Zone Transfer (AXFR) and Bulk Record Enumeration Against Authoritative Nameservers in Microsoft Sentinel
Adversaries scoping an external attack surface frequently target the victim's authoritative nameservers directly, attempting a full DNS zone transfer (AXFR, and its incremental sibling IXFR) in the hope of finding a misconfigured 'allow-transfer any' ACL. A successful AXFR dumps every record in the zone in one response — internal hostnames, mail server (MX) and SPF/DKIM/DMARC TXT records revealing third-party SaaS relationships, service discovery (SRV) records, and sometimes internal IP addressing exposed through stale A/PTR entries — handing the adversary a ready-made map of the organization's external and semi-external footprint without a single port scan. When the transfer is refused (the common case on a correctly configured server), adversaries and OSINT/recon tooling such as dnsrecon, fierce, dnsenum, and dig-based scripts fall back to bulk enumeration: rapid, scripted queries across many record types (NS, MX, TXT, SOA, ANY) and many candidate subdomains against the authoritative server itself, rather than a passive third-party database. This detection targets that server-side behavioral signature — AXFR/IXFR requests and abnormal query-type/query-name diversity from a single external client hitting the authoritative nameserver in a short window — as observed in the nameserver's own query and transfer logs, distinct from the OSINT-tool-execution coverage on the T1590.002 technique page, which keys on endpoint process telemetry for the same tools rather than the server-side query pattern. Sandworm Team, APT41, and Magic Hound have all been documented conducting broad DNS and network-infrastructure reconnaissance ahead of infrastructure acquisition and initial-access operations, and the same fingerprint is produced just as often by legitimate DNS hygiene audits, misconfiguration scanners, and unauthorized red-team activity.
MITRE ATT&CK
- Tactic
- Reconnaissance
KQL Detection Query
// THREAT-Recon-DNSZoneTransferReconAttempt
// AXFR/IXFR zone transfer attempts and bulk multi-type/multi-name enumeration against an authoritative nameserver from an external client
let Lookback = 1h;
let BurstWindow = 10m;
let MinBulkQueries = 30;
let MinUniqueQueryTypes = 4;
let PrivateRanges = dynamic(["10.", "192.168.", "172.16.", "172.17.", "172.18.", "172.19.",
"172.20.", "172.21.", "172.22.", "172.23.", "172.24.", "172.25.",
"172.26.", "172.27.", "172.28.", "172.29.", "172.30.", "172.31.",
"127.", "169.254."]);
DnsEvents
| where TimeGenerated > ago(Lookback)
| where isnotempty(ClientIP) and isnotempty(QueryType)
| where not(ClientIP has_any (PrivateRanges))
| extend IsZoneTransfer = QueryType in ("AXFR", "IXFR", "252", "251")
| summarize
TotalQueries = count(),
ZoneTransferAttempts = countif(IsZoneTransfer),
UniqueQueryTypes = dcount(QueryType),
UniqueQueryNames = dcount(Name),
QueryTypesSeen = make_set(QueryType, 10),
SampleNames = make_set(Name, 10),
FirstSeen = min(TimeGenerated),
LastSeen = max(TimeGenerated)
by ClientIP, Computer, bin(TimeGenerated, BurstWindow)
| where ZoneTransferAttempts > 0 or (TotalQueries >= MinBulkQueries and UniqueQueryTypes >= MinUniqueQueryTypes)
| extend AlertType = iff(ZoneTransferAttempts > 0, "DNS Zone Transfer (AXFR/IXFR) Attempt", "Bulk DNS Record Enumeration")
| project FirstSeen, LastSeen, Computer, ClientIP, AlertType, ZoneTransferAttempts,
TotalQueries, UniqueQueryTypes, UniqueQueryNames, QueryTypesSeen, SampleNames
| sort by ZoneTransferAttempts desc, TotalQueries descDetects DNS zone transfer and bulk enumeration attempts against an authoritative nameserver by grouping queries per external ClientIP/nameserver pair over a 10-minute window. Any AXFR/IXFR query (matched by name or DNS TYPE code 252/251) immediately flags as a zone-transfer attempt regardless of volume; absent that, a client querying 30+ times across 4+ distinct record types in the window flags as bulk enumeration, the pattern produced by dnsrecon/fierce/dnsenum-style scripted lookups against the server itself. Requires Windows DNS Server analytic/debug logging ingested into DnsEvents (via Azure Monitor Agent) on the authoritative server(s), not client-side resolver telemetry.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate secondary/slave nameserver replication — AXFR/IXFR from documented secondary NS IPs configured in the zone's NS records is expected and should be allowlisted by ClientIP
- Managed DNS or anycast providers (e.g., NS1, Cloudflare, AWS Route 53, dnsmadeeasy) pulling zone data via scheduled AXFR from a documented, stable set of provider IPs
- Internal DNS-as-code tooling (dnscontrol, octoDNS) or configuration-drift auditors performing scheduled AXFR checks against test or staging zones
- Authorized penetration testing or DNS hygiene audits explicitly scoped to probe zone-transfer misconfiguration, typically from a documented engagement IP
- Monitoring/uptime services or DNS health-check platforms issuing rapid, multi-record-type lookups (NS/MX/SOA/TXT) as part of a scheduled domain health check
Other platforms for THREAT-Recon-DNSZoneTransferReconAttempt
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate External AXFR Zone Transfer Attempt via dig
Expected signal: DNS server query/transfer log entry showing a TCP/53 session and an AXFR-type request for df00tech-zonetransfer-test.internal from the test host; if no authoritative nameserver is listening on 127.0.0.1 the request fails immediately, but the outbound TCP/53 attempt and (on a lab BIND/Windows DNS instance) the query log entry are still generated for detection validation.
- Test 2Simulate Bulk Multi-Type DNS Record Enumeration via Scripted dig Loop
Expected signal: DNS server query log records approximately 40 queries from the test host spanning 8 distinct query types (NS/MX/TXT/SOA/A/AAAA/CNAME/SRV) and 5 distinct subdomain names within a short window.
- Test 3Simulate Bulk ANY-Type Query Sweep via nslookup on Windows
Expected signal: Windows DNS Server analytic log / DnsEvents entries for 12 ANY-type queries from the test host against 12 distinct subdomain names within a short window, ingested via Azure Monitor Agent.
References (7)
Unlock playbooks & atomic tests with Pro
Get the full detection package for THREAT-Recon-DNSZoneTransferReconAttempt — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month