detection.wiki

Microsoft-Windows-DNS-Server-Service › Event 7693

Event ID 7693 — The XfrScopeOptionValue has been set to Name.

Provider
Microsoft-Windows-DNS-Server-Service
Channel
DNS Server
Level
Informational

Description

The XfrScopeOptionValue has been set to Name. This option ID will be used to communicate the scope information during zone transfers via an OPT RR.

Message #

The XfrScopeOptionValue has been set to %1.  This option ID will be used to communicate the scope information during zone transfers via an OPT RR.

Fields #

NameDescription
Name—
Data—
Binary—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DNS-Server-Service",
    "guid": "71A551F5-C893-4849-886B-B5EC8502641E",
    "event_source_name": "",
    "event_id": 7693,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854779904,
    "time_created": "2022-04-07T16:53:24.111885+00:00",
    "event_record_id": 23,
    "correlation": {},
    "execution": {
      "process_id": 2320,
      "thread_id": 2848
    },
    "channel": "DNS Server",
    "computer": "WIN-FPV0DSIC9O6.lab.local",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Name": "DNS_EVENT_SCOPE_EDNS_OPCODE_SET",
    "Data": {
      "Name": "param1",
      "Value": 65433
    },
    "Binary": ""
  },
  "message": ""
}

References #