Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for THREAT-Recon-SubdomainBruteforceNXDOMAINStorm.
Upgrade to ProDetect Subdomain Bruteforce Causing NXDOMAIN Storm in Microsoft Sentinel
Before selecting a phishing pretext, staging infrastructure, or an external-facing service to target, adversaries frequently brute-force an organization's DNS namespace with a wordlist of common subdomain labels (vpn, mail, sso, dev, staging, api, remote, citrix, owa, etc.) to enumerate hosts that are not otherwise advertised. Tools such as dnsx, massdns, puredns, gobuster (dns mode), dnsrecon, and fierce resolve tens of thousands of candidate labels per minute against the target's authoritative or recursive DNS servers. Because most guessed labels do not correspond to a real record, this activity produces a highly distinctive footprint at the DNS server: a single source issuing an extremely high volume of queries against the organization's domain(s) within a short window, the overwhelming majority of which return NXDOMAIN, with very little repetition between query names (each guess is unique, unlike a caching resolver replaying the same handful of hostnames). This is distinct from the broader DNS/passive-DNS reconnaissance techniques already covered on the parent T1596.001 page (which include zone-transfer attempts and tool-execution detection) in that it isolates the specific volumetric NXDOMAIN-ratio signature that a bruteforce sweep leaves on the DNS server itself, catching enumeration even when the querying tool cannot be observed on an endpoint (e.g., run from an external host, a compromised third-party network, or a VPS with no EDR visibility) and regardless of which specific tool was used to generate the wordlist traffic. Scattered Spider and other access brokers routinely run this style of sweep against a target's public domain ahead of helpdesk-vishing and SSO-phishing campaigns to build a list of live internal-sounding hostnames to reference for pretext and targeting.
MITRE ATT&CK
- Tactic
- Reconnaissance
KQL Detection Query
// THREAT: Subdomain Bruteforce NXDOMAIN Storm (Reconnaissance, T1596.001)
// Detects wordlist-driven subdomain enumeration against the organization's own
// DNS servers: a single client IP generating a very high query volume with an
// overwhelming NXDOMAIN ratio and near-1:1 unique-name-to-query ratio (each
// guess is a distinct label, unlike normal caching resolver traffic).
// Source: DnsEvents (Azure DNS Analytics solution / Microsoft DNS Server connector)
let LookbackWindow = 15m;
let MinTotalQueries = 200;
let MinNxDomainRatio = 0.85;
let MinUniqueLabelRatio = 0.90;
DnsEvents
| where TimeGenerated > ago(LookbackWindow)
| where QueryType in ("A", "AAAA", "CNAME", "MX", "TXT", "SRV", "NS")
| summarize
TotalQueries = count(),
UniqueSubdomains = dcount(Name),
NxDomainCount = countif(ResultCode =~ "NXDOMAIN"),
QueryTypes = make_set(QueryType, 10),
SampleQueries = make_set(Name, 5),
FirstSeen = min(TimeGenerated),
LastSeen = max(TimeGenerated)
by ClientIP, bin(TimeGenerated, LookbackWindow)
| extend NxDomainRatio = round(NxDomainCount * 1.0 / TotalQueries, 2)
| extend UniqueLabelRatio = round(UniqueSubdomains * 1.0 / TotalQueries, 2)
| where TotalQueries >= MinTotalQueries and NxDomainRatio >= MinNxDomainRatio and UniqueLabelRatio >= MinUniqueLabelRatio
| extend ThreatType = "SubdomainBruteforce_NXDOMAINStorm"
| extend Severity = iff(TotalQueries >= 2000, "High", "Medium")
| sort by TotalQueries descAggregates DNS queries per client IP over 15-minute windows using the DnsEvents table (requires Azure DNS Analytics or the Microsoft DNS Server connector) and flags a source once it crosses 200+ queries in the window with an NXDOMAIN ratio of 85%+ and a unique-query-name ratio of 90%+ — the combination that distinguishes wordlist-driven subdomain bruteforce from normal resolver traffic (which repeats a small set of cached names and rarely returns majority NXDOMAIN). Tune thresholds down for smaller DNS estates and up for high-traffic public resolvers.
Data Sources
Required Tables
False Positives & Tuning
- Authorized attack-surface management or vulnerability scanning platforms (Censys, Shodan Enterprise, Tenable ASM, BitSight) performing scheduled subdomain discovery sweeps against the organization's own domains
- Internal red team or pentest engagements running subdomain enumeration as part of an authorized reconnaissance phase
- Misconfigured internal applications or scripts with a typo'd or stale hostname list that retry against many non-existent names in a tight loop
- Wildcard DNS misconfiguration or a recently decommissioned subdomain still being queried at volume by clients with stale cached configuration
- DNS-based security research crawlers (e.g., certificate transparency monitors, threat-intel feeds) validating large candidate-subdomain lists against public zones
Other platforms for THREAT-Recon-SubdomainBruteforceNXDOMAINStorm
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Subdomain Bruteforce Simulation via dnsx
Expected signal: DNS server query logs record several hundred queries within a short window from the test source IP, with the large majority returning NXDOMAIN and each query name unique (near-1:1 unique-name-to-query ratio).
- Test 2High-Speed Bruteforce Simulation via massdns
Expected signal: DNS server logs show a sharp spike in query volume from the test source IP within seconds to minutes, with the overwhelming majority of responses being NXDOMAIN.
- Test 3Low-and-Slow Throttled Enumeration Simulation
Expected signal: DNS server logs record roughly 80 queries spread over about 40 minutes from the test source IP, nearly all returning NXDOMAIN, each with a unique query name.
Unlock playbooks & atomic tests with Pro
Get the full detection package for THREAT-Recon-SubdomainBruteforceNXDOMAINStorm — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month