This note documents detection patterns related to DNS Enumeration within Active Directory environments.
Direct Indicators
| Log | Event ID | Meaning | Forensic Value | Notes |
|---|---|---|---|---|
| DNS Server Log | N/A | DNS query logged | High | Queries for internal hostnames and domain records. |
| Security | 4624 | Successful logon | Medium | Authentication associated with enumeration host. |
| Sysmon | 3 | Network connection | Medium | DNS queries to internal DNS servers. |
| Sysmon | 1 | Process creation | High | Execution of DNS reconnaissance tools. |
Indirect Indicators
| Indicator | What To Look For | Forensic Value | Notes |
|---|---|---|---|
| High volume DNS queries | Multiple DNS lookups within short time | High | Typical reconnaissance behavior. |
| Enumeration tool execution | dnsrecon, nslookup loops, PowerShell DNS queries | Medium | Discovery activity. |
| Queries for domain controllers | DNS requests targeting DC hostnames | High | Indicates domain mapping. |
Common Tools
| Tool | Usage |
|---|---|
| nslookup | Native DNS query tool. |
| dnsrecon | Automated DNS reconnaissance. |
| dig | DNS enumeration tool. |
| PowerView | Enumerates domain infrastructure. |
Relevant Artifacts
- DNS server logs
- Network traffic logs
- Sysmon process logs
- EDR telemetry
- Security logs
MITRE ATT&CK References
- T1046 Network Service Discovery
- T1590 Gather Victim Network Information
Decision Tree
- Detect DNS query spikes.
- Identify querying host.
- Review query types and targets.
- Inspect process responsible for queries.
- Determine reconnaissance scope.
Example Detection Templates
KQL
DnsEvents
| summarize count() by Name, bin(TimeGenerated,5m)
EQL
network where destination.port == 53
Sigma
title: DNS Enumeration Activity
logsource:
product: network
detection:
selection:
destination_port: 53
condition: selection
level: medium
Mitigation & Hardening
| Control Area | Mitigation | Effectiveness | Notes |
|---|---|---|---|
| Monitoring | Alert on abnormal DNS query volume | Medium | Detects reconnaissance. |
| Network segmentation | Restrict DNS queries | Low | Limits exposure. |
| Logging | Enable DNS query logging | High | Improves visibility. |