DNS Server Failed to Load Plugin DLL

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•21

Detects a DNS server error indicating that a specified plugin DLL, configured in the registry, could not be loaded. This event can be triggered by an attacker attempting to load a malicious DLL for privilege escalation or persistence on a DNS server, often associated with techniques like DNSAdmin to DC compromise.