New DNS ServerLevelPluginDll Installed

Title: New DNS ServerLevelPluginDll Installed
Status: test
Description:Detects the installation of a DNS plugin DLL via ServerLevelPluginDll parameter in registry, which can be used to execute code in context of the DNS server (restart required)
References:
  -https://medium.com/@esnesenon/feature-not-bug-dnsadmin-to-dc-compromise-in-one-line-a0f779b8dc83
  -https://blog.3or.de/hunting-dns-server-level-plugin-dll-injection.html
Author: Florian Roth (Nextron Systems)
Date: 2017-05-08
modified:2023-08-17
Tags:

• -'attack.privilege-escalation'
• -'attack.persistence'
• -'attack.execution'
• -'attack.stealth'
• -'attack.defense-impairment'
• -'attack.t1574.001'
• -'attack.t1112'

Logsource:

• product: windows
• category: registry_set

Detection:
  selection:
    TargetObject|endswith: '\services\DNS\Parameters\ServerLevelPluginDll'
  condition:selection
Falsepositives:
  -Unknown
Level: high