AD-Integrated DNS Wildcard Record Abuse (ADIDNS Poisoning)

17 DNS ADIDNS Wildcard Abuse

Query

let WindowStart = ago(2h);
let WindowMid   = ago(1h);
// FQDNs returning NXDOMAIN in hour 1 (did not exist / unregistered)
let PreviouslyNxdomain =
    ASimDnsActivityLogs
    | where TimeGenerated between (WindowStart .. WindowMid)
    | where DnsResponseCodeName =~ "NXDOMAIN" or DnsResponseCode == 3
    | where DnsQueryTypeName in~ ("A", "AAAA")
    | summarize NxClients = dcount(SrcIpAddr) by DnsQuery
    | where NxClients >= 2;  // at least 2 different clients looked it up
// Same FQDNs now returning NOERROR in hour 2 (suddenly resolved)
let NowResolved =
    ASimDnsActivityLogs
    | where TimeGenerated between (WindowMid .. now())
    | where DnsResponseCodeName =~ "NOERROR" or DnsResponseCode == 0
    | where DnsQueryTypeName in~ ("A", "AAAA")
    | summarize
        ResolvedClients = dcount(SrcIpAddr),
        AffectedHosts   = make_set(SrcHostname, 15),
        FirstResolution = min(TimeGenerated)
      by DnsQuery
    | where ResolvedClients >= 2;
// Inner join: only domains that flipped NXDOMAIN → NOERROR
PreviouslyNxdomain
| join kind=inner NowResolved on DnsQuery
| summarize
    FlippedDomains  = count(),
    SampleDomains   = make_set(DnsQuery, 25),
    AffectedClients = max(ResolvedClients),
    AffectedHosts   = make_set(AffectedHosts, 10),
    FirstFlipTime   = min(FirstResolution)
| where FlippedDomains >= 10

Explanation

This query is designed to detect a specific type of DNS attack called "AD-Integrated DNS Wildcard Record Abuse" or "ADIDNS Poisoning." Here's a simplified explanation:

Purpose: The query identifies when an attacker adds a wildcard DNS record in an Active Directory Integrated DNS environment. This allows the attacker to redirect all unresolved DNS queries to their own IP address, enabling attacks like Man-in-the-Middle (MiTM), SMB relay, and credential capture.
Detection Method:
- The query looks at DNS activity over a 2-hour period.
- In the first hour, it identifies Fully Qualified Domain Names (FQDNs) that returned an "NXDOMAIN" response, meaning they didn't exist or weren't registered.
- In the second hour, it checks if those same FQDNs suddenly start resolving successfully with a "NOERROR" response.
- If this change happens for 10 or more domains, it indicates a potential attack.
Technical Details:
- The query uses logs from Windows DNS servers.
- It requires at least two different clients to have queried the domains to consider them in the analysis.
- The query runs every 30 minutes and looks back over the last 2 hours.
Severity and Impact:
- The severity is marked as "High" because this attack can compromise network security without needing elevated privileges.
- It affects multiple clients and can be used to capture sensitive information.
Alerting:
- If the query detects this pattern, it generates an alert indicating the number of domains affected and provides sample domains involved in the potential attack.

Overall, this query helps security teams detect and respond to DNS-based attacks in environments where traditional broadcast poisoning techniques are not possible.

Details

David Alonso

Released: July 28, 2026

Tables

ASimDnsActivityLogs

Keywords

ActiveDirectoryDNSMiTMSMBRelayLLMNRNBT-NSFQDNHostnamesIPClientsDomains

Operators

letagobetween=~orin~summarizedcountwheremake_setminnowjoinkind=inneroncountmax

Severity

High

Tactics

CredentialAccessLateralMovementCollection

MITRE Techniques

T1557.001 T1584.002

Frequency: 30m

Period: 2h

Actions

GitHub

KQL Search