New DNS ServerLevelPluginDll Installed
Detects the installation of a DNS plugin DLL by monitoring modifications to the 'ServerLevelPluginDll' registry parameter. This technique can be used by adversaries to execute arbitrary code within the context of the DNS server, often requiring a restart of the DNS service to take effect. This can lead to privilege escalation and persistence on a compromised system.
Sigma
