DNS RCE CVE-2020-1350 Exploitation

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•26

Detects exploitation of the DNS RCE vulnerability (CVE-2020-1350) by monitoring for suspicious sub-processes spawned by the `dns.exe` service. This rule specifically looks for processes created by `dns.exe` that are not common or expected system processes, indicating potential post-exploitation activity after successful exploitation of the vulnerability.