New DNS ServerLevelPluginDll Installed Via Dnscmd.EXE

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•16

Detects the installation of a DNS plugin DLL via ServerLevelPluginDll parameter in the registry using dnscmd.exe, which can be used to execute code in the context of the DNS server (restart required). This technique can be used for privilege escalation or persistence.