Failed DNS Zone Transfer

Title: Failed DNS Zone Transfer
Status: test
Description:Detects when a DNS zone transfer failed.
References:
  -https://kb.eventtracker.com/evtpass/evtpages/EventId_6004_Microsoft-Windows-DNS-Server-Service_65410.asp
Author: Zach Mathis
Date: 2023-05-24
modified:None
Tags:

• -'attack.reconnaissance'
• -'attack.t1590.002'

Logsource:

• product: windows
• service: dns-server

Detection:
  selection:
    EventID: '6004'
  condition:selection
Falsepositives:
  -Unlikely
Level: medium