Recon via DNS Zone Transfer or Subdomain Enumeration Spray (T1590)

Arnold Chan@slaz

•updated Aug 27, 2026•1•0•4

Detects anomalous DNS activity characterized by either unauthorized DNS zone transfer (AXFR/IXFR) requests or aggressive subdomain enumeration patterns from external IP addresses. This rule monitors for high volumes of non-standard DNS queries or distinct subdomain lookups within a 15-minute window, which are common precursors to reconnaissance activities.