IMPORTANT: No additional bug fixes or documentation updates will be released for this version. For the latest information, see the current release documentation.
« Unusual Child Process of dns.exe Suspicious Startup Shell Folder Modification »
Elastic Docs ›Elastic Security [8.18] ›Downloadable rule update v8.18.14

Unusual File Operation by dns.exe

edit
A newer version is available. Check out the latest documentation.

Unusual File Operation by dns.exe

edit

Identifies an unexpected file being modified by dns.exe, the process responsible for Windows DNS Server services, which may indicate activity related to remote code execution or other forms of exploitation.

Rule type: new_terms

Rule indices:

  • winlogbeat-*
  • logs-endpoint.events.file-*
  • logs-windows.sysmon_operational-*
  • endgame-*

Severity: medium

Risk score: 47

Runs every: 5m

Searches indices from: now-9m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References:

Tags:

  • Domain: Endpoint
  • OS: Windows
  • Use Case: Threat Detection
  • Tactic: Lateral Movement
  • Data Source: Elastic Endgame
  • Use Case: Vulnerability
  • Data Source: Elastic Defend
  • Data Source: Sysmon

Version: 215

Rule authors:

  • Elastic

Rule license: Elastic License v2

Rule query

edit
event.category : "file" and host.os.type : "windows" and
  event.type : ("creation" or "deletion" or "change") and process.name : "dns.exe" and
  not file.extension : ("old" or "temp" or "bak" or "dns" or "arpa" or "log")

Framework: MITRE ATT&CKTM

« Unusual Child Process of dns.exe Suspicious Startup Shell Folder Modification »