Potential DNS Discovery Activity Via Dnscmd.EXE

SigmaHQ Detections@sigmaHQ

•updated May 20, 2025•1•0•21

Detects an attempt to leverage dnscmd.exe to enumerate DNS zones or records of a domain. This activity can be indicative of reconnaissance by an attacker.