Compromise Infrastructure: DNS Server `T1584.002`

Tactic: Resource Development

Adversaries may compromise third-party DNS servers that can be used during targeting. During post-compromise activity, adversaries may utilize DNS traffic for various tasks, including for Command and Control (ex: Application Layer Protocol). Instead of setting up their own DNS servers, adversaries may compromise third-party DNS servers in support of operations.

Authoring guide

These 1 rule share fields, values, and exclusions.

Fields filtered most (7 distinct)

These fields appear most often in rule filters.

Field	Rules	How	Sample values
`NewDnsSecState`	1	`eq` 1	`OFF`
`OldDnsSecState`	1	`eq` 1	`ON`
`ServiceName`	1	`eq` 1	`dns.googleapis.com`
`Severity`	1	`eq` 1	`NOTICE`
`ZoneContext`	1	`is_not_null` 1
`gcp::method_name`	1	`in` 1	`dns.managedZones.patch`, `dns.managedZones.update`
`gcp::resource_type`	1	`eq` 1	`dns_managed_zone`

Top indicator values (7 distinct)

These values appear most often in rule predicates.

Field	Kind	Value	Rules (here)	Corpus reach
`NewDnsSecState`	`eq`	`OFF` kustoGCP Audit Logs - DNSSEC Disabled on Managed DNS Zone	1
`OldDnsSecState`	`eq`	`ON` kustoGCP Audit Logs - DNSSEC Disabled on Managed DNS Zone	1
`ServiceName`	`eq`	`dns.googleapis.com` kustoGCP Audit Logs - DNSSEC Disabled on Managed DNS Zone	1
`Severity`	`eq`	`NOTICE` kustoGCP Audit Logs - DNSSEC Disabled on Managed DNS Zone	1	4
`gcp::method_name`	`in`	`dns.managedZones.patch` kustoGCP Audit Logs - DNSSEC Disabled on Managed DNS Zone	1
`gcp::method_name`	`in`	`dns.managedZones.update` kustoGCP Audit Logs - DNSSEC Disabled on Managed DNS Zone	1
`gcp::resource_type`	`eq`	`dns_managed_zone` kustoGCP Audit Logs - DNSSEC Disabled on Managed DNS Zone	1

Rules under this technique

These vendors publish rules tagged with this technique.

Platform: GCP

Domain: Cloud

Kusto 1 rule