Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for THREAT-Recon-DNSZoneTransferReconAttempt.
Upgrade to ProDetect Unauthorized DNS Zone Transfer (AXFR) and Bulk Record Enumeration Against Authoritative Nameservers in Sumo Logic CSE
Adversaries scoping an external attack surface frequently target the victim's authoritative nameservers directly, attempting a full DNS zone transfer (AXFR, and its incremental sibling IXFR) in the hope of finding a misconfigured 'allow-transfer any' ACL. A successful AXFR dumps every record in the zone in one response — internal hostnames, mail server (MX) and SPF/DKIM/DMARC TXT records revealing third-party SaaS relationships, service discovery (SRV) records, and sometimes internal IP addressing exposed through stale A/PTR entries — handing the adversary a ready-made map of the organization's external and semi-external footprint without a single port scan. When the transfer is refused (the common case on a correctly configured server), adversaries and OSINT/recon tooling such as dnsrecon, fierce, dnsenum, and dig-based scripts fall back to bulk enumeration: rapid, scripted queries across many record types (NS, MX, TXT, SOA, ANY) and many candidate subdomains against the authoritative server itself, rather than a passive third-party database. This detection targets that server-side behavioral signature — AXFR/IXFR requests and abnormal query-type/query-name diversity from a single external client hitting the authoritative nameserver in a short window — as observed in the nameserver's own query and transfer logs, distinct from the OSINT-tool-execution coverage on the T1590.002 technique page, which keys on endpoint process telemetry for the same tools rather than the server-side query pattern. Sandworm Team, APT41, and Magic Hound have all been documented conducting broad DNS and network-infrastructure reconnaissance ahead of infrastructure acquisition and initial-access operations, and the same fingerprint is produced just as often by legitimate DNS hygiene audits, misconfiguration scanners, and unauthorized red-team activity.
MITRE ATT&CK
- Tactic
- Reconnaissance
Sumo Detection Query
_sourceCategory=*dns* OR _sourceCategory=*bind* OR _sourceCategory=*infoblox*
| parse regex field=_raw "client\s+(?<client_ip>[0-9\.]+)#\d+.*query:\s+(?<qname>\S+)\s+IN\s+(?<qtype>\S+)"
| where !isNull(client_ip) and !isNull(qtype)
| eval is_zone_transfer=if(qtype matches "AXFR" or qtype matches "IXFR", 1, 0)
| timeslice 10m
| count as total_queries, sum(is_zone_transfer) as zone_transfer_attempts, count_distinct(qtype) as unique_query_types, count_distinct(qname) as unique_query_names by client_ip, _timeslice
| where zone_transfer_attempts > 0 or (total_queries >= 30 and unique_query_types >= 4)
| sort by zone_transfer_attempts desc, total_queries descSumo Logic search parsing BIND-style querylog lines (client/query/type) or Infoblox DNS query audit events into structured fields, then bucketing into 10-minute time slices per client IP to compute total query volume, zone-transfer-attempt count, and query-type/query-name cardinality — surfacing the same zone-transfer and bulk-enumeration signature as the KQL and SPL versions.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate secondary/slave nameserver replication from documented secondary NS IPs
- Managed DNS or anycast providers pulling zone data via scheduled AXFR from a documented set of provider IPs
- Internal DNS-as-code tooling or configuration-drift auditors performing scheduled AXFR checks against test zones
Other platforms for THREAT-Recon-DNSZoneTransferReconAttempt
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate External AXFR Zone Transfer Attempt via dig
Expected signal: DNS server query/transfer log entry showing a TCP/53 session and an AXFR-type request for df00tech-zonetransfer-test.internal from the test host; if no authoritative nameserver is listening on 127.0.0.1 the request fails immediately, but the outbound TCP/53 attempt and (on a lab BIND/Windows DNS instance) the query log entry are still generated for detection validation.
- Test 2Simulate Bulk Multi-Type DNS Record Enumeration via Scripted dig Loop
Expected signal: DNS server query log records approximately 40 queries from the test host spanning 8 distinct query types (NS/MX/TXT/SOA/A/AAAA/CNAME/SRV) and 5 distinct subdomain names within a short window.
- Test 3Simulate Bulk ANY-Type Query Sweep via nslookup on Windows
Expected signal: Windows DNS Server analytic log / DnsEvents entries for 12 ANY-type queries from the test host against 12 distinct subdomain names within a short window, ingested via Azure Monitor Agent.
References (7)
Unlock playbooks & atomic tests with Pro
Get the full detection package for THREAT-Recon-DNSZoneTransferReconAttempt — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month