Borrowed Trust: Azure DNS Orphaned Zone Takeover - New Zone Creation

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•2

This rule detects the creation of Azure DNS zones by callers who have no prior history of writing to DNS zones within a specified lookback period. This behavior can indicate an attempt at DNS zone takeover, as observed in campaigns like 'Borrowed Trust' or 'link99', where adversaries might create orphaned DNS zones to redirect traffic or host malicious content.