Subdomain Enumeration Burst — DNS Brute-Force Reconnaissance
15 DNS Subdomain Enum Brute Force
Query
ASimDnsActivityLogs
| where TimeGenerated > ago(1h)
| extend BaseDomain = strcat(
tostring(split(DnsQuery, ".")[-2]), ".",
tostring(split(DnsQuery, ".")[-1])
)
| where isnotempty(BaseDomain) and BaseDomain !~ "."
| summarize
SubdomainCount = dcount(DnsQuery),
TotalQueries = count(),
NxdomainCount = countif(DnsResponseCodeName =~ "NXDOMAIN" or DnsResponseCode == 3),
SampleSubs = make_set(DnsQuery, 15),
FirstSeen = min(TimeGenerated),
LastSeen = max(TimeGenerated)
by SrcIpAddr, SrcHostname, BaseDomain
| where SubdomainCount > 75
| extend NxdomainRate = round(todouble(NxdomainCount) / todouble(TotalQueries) * 100.0, 1)
| where NxdomainRate > 40Explanation
This query is designed to detect suspicious activity related to DNS subdomain enumeration, which is a technique often used by attackers to discover potential targets within a domain. Here's a simplified breakdown of what the query does:
-
Purpose: It identifies instances where a single client (identified by IP address or hostname) attempts to resolve a large number of unique subdomains (more than 75) of the same base domain within a one-hour period. This behavior is indicative of automated tools being used for reconnaissance.
-
Data Source: The query uses DNS activity logs from a data connector called
WindowsDnsAma. -
Detection Logic:
- It looks at DNS queries made in the last hour.
- It extracts the base domain from each DNS query.
- It counts how many unique subdomains are queried for each base domain by each client.
- It also calculates the percentage of these queries that result in a "non-existent domain" (NXDOMAIN) response, which should be over 40% to trigger an alert.
-
Alerting: If the conditions are met (more than 75 unique subdomains queried with an NXDOMAIN rate over 40%), an alert is generated. The alert includes details such as the number of subdomains queried, the base domain, and a sample of the subdomains queried.
-
Severity and Tactics: The severity of this activity is classified as "Medium," and it is associated with reconnaissance and discovery tactics, specifically aligning with MITRE techniques T1590.002 (Gather Victim Network Information: DNS) and T1046 (Network Service Discovery).
-
Tools: The query mentions several tools that could generate such patterns, including dnsniper, sublist3r, amass, massdns, dnsrecon, gobuster in DNS mode, and ffuf in DNS mode.
Overall, this query helps security teams identify potential reconnaissance activities that could indicate an attacker is mapping out a network's structure by probing for subdomains.
Details
David Alonso
Released: July 28, 2026
Tables
Keywords
Operators
Severity
MediumTactics
Frequency: 1h
Period: 1h