Failed DNS Zone Transfer Attempt
This rule detects when a DNS server receives a zone transfer request for a non-existent or non-authoritative zone, indicated by EventID 6004 from the Microsoft-Windows-DNS-Server-Service. This event signifies an attempt to perform a DNS zone transfer that was rejected by the DNS server. Such attempts can be part of reconnaissance activities by adversaries trying to map out a network's DNS infrastructure.
Sigma
