KQL Search

This query is designed to detect potentially malicious activity involving the use of PowerShell commands to export or enumerate DNS zones, which could indicate an adversary's attempt to map out internal networks for further attacks. Here's a simplified breakdown:

1. Purpose: The query identifies when specific PowerShell commands (Export-DnsServerZone and Get-DnsServerZone) are executed. These commands can be used by attackers to gather information about internal network hosts and services.

2. Exclusions: It filters out routine, benign uses of these commands, such as those initiated by known monitoring software (MonitoringHost.exe -Embedding), to reduce false alarms.

3. Focus: The query is particularly concerned with:

   • Non-administrative users running these commands.
   • Execution from systems that are not typically DNS servers.
   • Activity occurring outside normal business hours or scheduled maintenance times.

4. Correlations: It suggests further investigation if:

   • There are unusual DNS queries or a high volume of DNS lookups from the same machine.
   • DNS data is exported to unexpected file locations.
   • There is evidence of lateral movement or attempts to escalate privileges shortly after the DNS commands are run.

5. Relevance: This detection is part of a broader effort to identify reconnaissance activities, which are often precursors to more serious attacks. It aligns with specific tactics in the MITRE ATT&CK framework, such as discovering network configurations and services.

Overall, this query helps security teams spot and investigate suspicious DNS-related activities that could indicate an adversary's reconnaissance efforts.