DNS Server Error Failed Loading the ServerLevelPluginDLL

 1title: DNS Server Error Failed Loading the ServerLevelPluginDLL
 2id: cbe51394-cd93-4473-b555-edf0144952d9
 3related:
 4    - id: e61e8a88-59a9-451c-874e-70fcc9740d67
 5      type: derived
 6    - id: f63b56ee-3f79-4b8a-97fb-5c48007e8573
 7      type: derived
 8status: test
 9description: Detects a DNS server error in which a specified plugin DLL (in registry) could not be loaded
10references:
11    - https://medium.com/@esnesenon/feature-not-bug-dnsadmin-to-dc-compromise-in-one-line-a0f779b8dc83
12    - https://technet.microsoft.com/en-us/library/cc735829(v=ws.10).aspx
13    - https://twitter.com/gentilkiwi/status/861641945944391680
14author: Florian Roth (Nextron Systems)
15date: 2017-05-08
16modified: 2023-02-05
17tags:
18    - attack.privilege-escalation
19    - attack.persistence
20    - attack.defense-evasion
21    - attack.t1574.001
22logsource:
23    product: windows
24    service: dns-server
25detection:
26    selection:
27        EventID:
28            - 150
29            - 770
30            - 771
31    condition: selection
32falsepositives:
33    - Unknown
34level: high

References

• Feature, not bug: DNSAdmin to DC compromise in one line

  

  Background

  
  Read More

• Event ID 150 — DNS Server Configuration

  

  Applies To: Windows Server 2008 The DNS server configuration consists of the settings that determine how the DNS server will function on a network and how those settings are stored and retrieved wh...

  
  Read More

• 

  Something went wrong, but don’t fret — let’s give it another shot. Some privacy related extensions may cause issues on x.com. Please disable them and try again.

  
  Read More

Related rules

• APT27 - Emissary Panda Activity
• Aruba Network Service Potential DLL Sideloading
• Creation of WerFault.exe/Wer.dll in Unusual Folder
• DHCP Callout DLL Installation
• DHCP Server Error Failed Loading the CallOut DLL