Detection rules › Elastic

Potential WPAD Spoofing via DNS Record Creation

Author
Elastic
Source
upstream

Identifies the creation of a DNS record that is potentially meant to enable WPAD spoofing. Attackers can disable the Global Query Block List (GQBL) and create a "wpad" record to exploit hosts running WPAD with default settings for privilege escalation and lateral movement.

MITRE ATT&CK coverage

TacticTechniques
Credential AccessT1557 Adversary-in-the-Middle
CollectionT1557 Adversary-in-the-Middle

Event coverage

ProviderEvent IDTitle
Security-Auditing5137A directory service object was created.

Stages and Predicates

Stage 1: eql:any

winlog.event_data.ObjectDN:"DC=wpad,*"

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
winlog.event_data.ObjectDNwildcard
  • DC=wpad,*