This note documents detection patterns related to ADIDNS Poisoning within Active Directory environments.

Direct Indicators

Log	Event ID	Meaning	Forensic Value	Notes
Security	5136	Directory object modified	Critical	Modification or creation of DNS records in Active Directory Integrated DNS zones.
Security	4662	Operation performed on object	High	LDAP operations modifying DNS node objects.
Security	5145	Network share object checked	Medium	Access to DNS configuration files or zone data.
Sysmon	1	Process creation	Medium	Execution of tools modifying DNS records.
Sysmon	3	Network connection	Medium	LDAP or RPC communication with domain controllers for DNS modification.
DNS Server Log	257	Dynamic DNS update	Critical	Creation or modification of DNS record in AD zone.

Indirect Indicators

Indicator	What To Look For	Forensic Value	Notes
Unexpected DNS record creation	New A or CNAME records pointing to attacker-controlled hosts	Critical	Typical poisoning indicator.
DNS records created by user accounts	Non-admin account creating DNS entries	High	Often indicates abuse of default permissions.
DNS entries resolving to internal attacker host	DNS record pointing to workstation IP	High	Used for relay or credential capture.
Rapid DNS modifications	Multiple DNS node updates in short time	Medium	Possible automated attack.
DNS records targeting authentication services	Records pointing to LDAP/SMB services	High	Used to redirect authentication traffic.

Common Tools

Tool	Usage
dnstool.py	Adds or modifies DNS records in AD-integrated zones.
Powermad	Creates machine accounts and DNS records.
PowerView	Used to manipulate ADIDNS entries.
Impacket	Provides scripts for DNS manipulation.
ADSIEdit	Manual modification of DNS node objects.

Relevant Artifacts

Domain controller Security logs (5136, 4662)
DNS server logs
Active Directory object metadata
LDAP modification logs
Sysmon logs (1, 3)
EDR telemetry identifying AD manipulation tools
DNS query logs
Prefetch artifacts for DNS manipulation tooling

MITRE ATT&CK References

T1565 Data Manipulation
T1565.001 Stored Data Manipulation
T1046 Network Service Discovery

Decision Tree

Is the suspicious event present?
- Identify DNS record creation or modification events.
What host generated the event?
- Determine workstation performing DNS update.
Is the account expected to perform this action?
- Investigate whether account normally manages DNS.
Pivot:
- Source host → inspect execution of dnstool or Powermad.
- DNS record → determine target IP address and service.
- Network → analyze authentication attempts using poisoned record.
Confirm exploitation
- Determine whether DNS poisoning redirected authentication or traffic.

Example Detection Templates

KQL

SecurityEvent
| where EventID == 5136
| where ObjectDN contains "DC=DomainDnsZones"

DnsEvents
| summarize count() by Name, IPAddresses, bin(TimeGenerated,5m)

EQL

any where event.code == "5136"

Sigma

title: Suspicious ADIDNS Record Modification
id: adidns-poisoning-detection
status: experimental
description: Detects modifications to AD-integrated DNS records
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 5136
  condition: selection
fields:
  - SubjectUserName
  - ObjectDN
falsepositives:
  - Legitimate DNS administration
level: high
tags:
  - attack.persistence

Mitigation & Hardening

Control Area	Mitigation	Effectiveness	Notes
DNS permissions	Restrict who can create DNS records	Critical	Prevents unauthorized record creation.
Monitoring	Alert on DNS node modifications	High	Detects poisoning attempts.
Network monitoring	Monitor unusual DNS resolutions	High	Identifies traffic redirection.
Least privilege	Remove default DNS update rights	Medium	Reduces attack surface.
Threat hunting	Review newly created DNS records	Medium	Detects suspicious entries.