DNSAdmins Privilege Escalation via DLL Injection (dnscmd /serverlevelplugindll)

16 DNS DNS Admin DLL Injection

Query

// Step 1: Detect dnscmd.exe invoked with /serverlevelplugindll
// (registers arbitrary DLL to be loaded by dns.exe at SYSTEM privilege)
let DnscmdAbuse =
    SecurityEvent
    | where TimeGenerated > ago(1h)
    | where EventID == 4688  // Process Creation (requires audit policy)
    | where NewProcessName has "dnscmd.exe"
    | where CommandLine has "serverlevelplugindll"
    | project
        DnscmdTime   = TimeGenerated,
        Computer,
        SubjectAccount = SubjectUserName,
        CommandLine;
// Step 2: Detect DNS service restart following the dnscmd call
// Restart is required to load the DLL — without it the attack is incomplete
let DnsServiceRestart =
    SecurityEvent
    | where TimeGenerated > ago(1h)
    | where EventID == 7036 or EventID == 4697
    | where Activity has "DNS" or ServiceName contains "DNS"
    | project
        RestartTime   = TimeGenerated,
        Computer,
        ServiceEvent  = Activity;
// Correlate: same Computer, restart within 60 min of dnscmd
DnscmdAbuse
| join kind=leftouter DnsServiceRestart on Computer
| where isnull(RestartTime) or abs(datetime_diff("minute", DnscmdTime, RestartTime)) < 60
| project
    DnscmdTime,
    Computer,
    SubjectAccount,
    CommandLine,
    RestartTime,
    ServiceEvent

Explanation

This query is designed to detect a specific security threat involving the DNSAdmins group in Active Directory. Here's a simplified explanation:

Purpose: The query identifies a potential privilege escalation attack where a member of the DNSAdmins group uses a technique called DLL injection to gain elevated privileges on a DNS server.
Technique: The attack involves using the dnscmd.exe command with the /serverlevelplugindll option to register a malicious DLL file. This DLL is then loaded by the DNS service (dns.exe), which runs with SYSTEM-level privileges.
Detection Steps:
- Step 1: The query looks for instances where dnscmd.exe is executed with the /serverlevelplugindll argument. This indicates an attempt to register a DLL.
- Step 2: It checks for a DNS service restart within 60 minutes of the dnscmd.exe execution. The restart is necessary for the DLL to be loaded and executed.
Conditions: Both the execution of dnscmd.exe and the DNS service restart must occur on the same computer within a 60-minute window for the alert to trigger.
Severity and Impact: The severity of this alert is high because it indicates a potential compromise where the attacker can execute code with SYSTEM privileges, which is a significant security risk.
References: The technique is associated with MITRE ATT&CK techniques T1574.002 (DLL Side-Loading) and T1078.002 (Domain Accounts - DNSAdmins group membership). It was publicly documented by Shay Ber in 2017.
Alert Details: If the conditions are met, an alert is generated with details about the user account involved, the computer affected, and the command line used.

Overall, this query helps security teams identify and respond to a specific method of privilege escalation that could lead to a severe security breach.

Details

David Alonso

Released: July 28, 2026

Tables

SecurityEvent

Keywords

DNSAdminsDLLInjectionPrivilegeEscalationSYSTEMActiveDirectoryDNSDomainControllerSecurityEventsSecurityEventComputerSubjectAccountCommandLineHostAccount

Operators

letwherehasprojectjoinkindonisnullabsdatetime_diff

Severity

High

Tactics

PrivilegeEscalationPersistence

MITRE Techniques

T1574.002 T1078.002

Frequency: 1h

Period: 1h

Actions

GitHub

KQL Search