Unusual File Deletion by Dns.exe

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•22

Detects an unexpected file deletion by the dns.exe process. This activity could indicate remote code execution or other forms of exploitation, potentially related to vulnerabilities like CVE-2020-1350 (SigRed), where an attacker might manipulate DNS server files.