This note documents detection patterns related to DNS Zone Transfer within Active Directory environments.

Direct Indicators

Log	Event ID	Meaning	Forensic Value	Notes
DNS Server Log	6001	Zone transfer requested	Critical	External host requested full DNS zone transfer.
DNS Server Log	6002	Zone transfer completed	Critical	Entire DNS zone transferred to remote host.
Security	4624	Successful logon	Medium	Authentication associated with DNS administration activity.
Sysmon	3	Network connection	High	Connection from external host requesting DNS zone data.
Firewall Logs	N/A	Large DNS responses	High	Large DNS packets associated with zone transfers.
Network IDS	N/A	AXFR request detected	Critical	Network-based detection of zone transfer attempt.

Indirect Indicators

Indicator	What To Look For	Forensic Value	Notes
Large DNS responses	DNS responses significantly larger than typical queries	High	Typical during AXFR transfers.
DNS queries for zone transfer type	AXFR or IXFR queries	Critical	Direct indicator of zone transfer attempt.
DNS server responding to unknown host	Transfer allowed to unauthorized system	Critical	Possible misconfiguration exploitation.
Multiple DNS records retrieved	Bulk DNS records transferred	High	Typical enumeration behavior.
External reconnaissance activity	DNS enumeration following zone transfer	Medium	Attackers mapping internal network.

Common Tools

Tool	Usage
dig	Performs DNS zone transfer requests using AXFR query.
nslookup	Can request zone transfers if permitted.
dnsrecon	Automates DNS enumeration including zone transfers.
fierce	Performs DNS reconnaissance.
Nmap NSE scripts	DNS enumeration including zone transfer checks.

Relevant Artifacts

DNS server logs
Firewall logs showing DNS traffic
Network IDS alerts for AXFR queries
Sysmon logs (3 network connections)
EDR telemetry identifying DNS reconnaissance tools
DNS query logs
Packet captures showing zone transfer traffic
SIEM correlation alerts

MITRE ATT&CK References

T1046 Network Service Discovery
T1595 Active Scanning
T1590 Gather Victim Network Information

Decision Tree

Is the suspicious event present?
- Identify AXFR or IXFR DNS queries.
What host generated the request?
- Determine source IP requesting zone transfer.
Is the host authorized for zone transfers?
- Check DNS server zone transfer configuration.
Pivot:
- Source host → investigate reconnaissance tools.
- DNS logs → determine records retrieved.
- Network traffic → inspect additional enumeration activity.
Confirm exploitation
- Determine whether attacker successfully retrieved full DNS zone data.

Example Detection Templates

KQL

DnsEvents
| where QueryType in ("AXFR","IXFR")

DeviceNetworkEvents
| where RemotePort == 53
| summarize count() by RemoteIP, bin(TimeGenerated,5m)

EQL

any where dns.question.type in ("AXFR","IXFR")

Sigma

title: DNS Zone Transfer Attempt
id: dns-zone-transfer-detection
status: experimental
description: Detects DNS zone transfer attempts using AXFR or IXFR queries
logsource:
  product: network
detection:
  selection:
    QueryType:
      - AXFR
      - IXFR
  condition: selection
fields:
  - src_ip
  - dns_query
falsepositives:
  - Legitimate zone replication between DNS servers
level: medium
tags:
  - attack.discovery

Mitigation & Hardening

Control Area	Mitigation	Effectiveness	Notes
DNS configuration	Restrict zone transfers to authorized servers	Critical	Prevents unauthorized enumeration.
Firewall rules	Block AXFR requests from external hosts	High	Limits exposure.
Monitoring	Alert on zone transfer requests	High	Detects reconnaissance activity.
Network segmentation	Isolate DNS infrastructure	Medium	Reduces attack surface.
Threat hunting	Review DNS logs for large responses	Medium	Identifies potential enumeration.