ATT&CK T1590 - DNS Zone Transfer via TCP

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•4

This rule detects DNS zone transfer attempts over TCP. It specifically looks for the byte sequence "|00 FC|" in TCP traffic destined for port 53, which is indicative of a DNS AXFR (zone transfer) request. This activity is often associated with reconnaissance by attackers to gather information about a network's DNS infrastructure.