ATT&CK T1590 - DNS Zone Transfer Attempt

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•4

This rule detects attempts to perform a DNS zone transfer. It specifically looks for UDP traffic on port 53 (DNS) destined for the home network, containing the byte sequence "|00 FC|" at an offset of 2 bytes with a depth of 2 bytes. This byte sequence corresponds to the 'AXFR' (Authoritative Zone Transfer) query type in a DNS request, which is often used by attackers for reconnaissance to enumerate DNS records for a domain.