Unsigned DLL loaded by DNS Service

Last updated 5 months ago on 2025-03-20

Created a year ago on 2024-05-29

About

Identifies unusual DLLs loaded by the DNS Server process, potentially indicating the abuse of the ServerLevelPluginDll functionality. This can lead to privilege escalation and remote code execution with SYSTEM privileges.

Tags

Domain: EndpointOS: WindowsUse Case: Threat DetectionTactic: Privilege EscalationData Source: Elastic DefendData Source: SysmonLanguage: eql

Severity

medium

Risk Score

MITRE ATT&CK™

Privilege Escalation (TA0004)(opens in a new tab or window)

↳ Exploitation for Privilege Escalation (T1068)(opens in a new tab or window)

License

Elastic License v2(opens in a new tab or window)

Definition

Rule Type

Event Correlation Rule

Integration Pack

Prebuilt Security Detection Rules

Index Patterns

logs-endpoint.events.library-*logs-windows.sysmon_operational-*winlogbeat-*

Related Integrations

endpoint(opens in a new tab or window)

windows(opens in a new tab or window)

Query

any where host.os.type == "windows" and event.category : ("library", "process") and
  event.type : ("start", "change") and event.action : ("load", "Image loaded*") and
  process.executable : "?:\\windows\\system32\\dns.exe" and
  not ?dll.code_signature.trusted == true and
  not file.code_signature.status == "Valid"

Install detection rules in Elastic Security

Detect Unsigned DLL loaded by DNS Service in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(opens in a new tab or window).