DNS Full Zone Transfer Request
This rule detects a DNS Full Zone Transfer Request. A zone transfer is a type of DNS transaction used to replicate DNS database files (zone files) from a primary DNS server to a secondary DNS server. While legitimate for DNS server synchronization, unauthorized zone transfers can be used by attackers to gather extensive information about a network's infrastructure, including hostnames, IP addresses, and other sensitive data, which can then be used for further reconnaissance and targeting. The rule specifically looks for UDP traffic to port 53 (DNS) and the content '|00 FC|' at offset 2, which corresponds to the AXFR (Authoritative Zone Transfer) query type.
Suricata
