Identifier / Programs / Windows
dnscmd.exe
A command-line interface for managing DNS servers. Windows commands reference
LOLBAS Execute 3 Sigma rules name it 3 ATT&CK techniques 1 documented command 2 known copies with hashes
How dnscmd.exe is abused
Execute T1543.003 Create or Modify System Process: Windows Service
-config/serverlevelplugindllSpecifies the path of a custom plug-in. Windows commands referenceEach abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for dnscmd.exe.
1 documented command
Execute T1543.003 Create or Modify System Process: Windows Service DNS admin privileges
Adds a specially crafted DLL as a plug-in of the DNS Service. This command must be run on a DC by a user that is at least a member of the DnsAdmins group. See the reference links for DLL details.
dnscmd.exe dc1.lab.int /config /serverlevelplugindll {PATH_SMB:.dll}Trips 1 Sigma rule: highNew DNS ServerLevelPluginDll Installed Via Dnscmd.EXE by Florian Roth (Nextron Systems)
The command the identifier reads trips a Sigma process-creation rule. These commands and their descriptions are from LOLBAS’s entry for dnscmd.exe, by Oddvar Moe, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for dnscmd.exe. The identifier reads it with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.
What detects it
Is it the real dnscmd.exe?
Installed in
C:\Windows\system32\Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionDNS Command Line Admin Utility
2 known copies
10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\dnscmd.exe · signed by Microsoft Windows
767ba0b95e453e01c5441df34d6c45f8725ec94136df96deefb605fca92ce2146.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\dnscmd.exe · not signed
67877821bf1574060f4e45ab8be62e28f54fb40a23ce70b86a6369a4d63db5bcFrom the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.
Options
Show every option of dnscmd.exe
/treeSpecifies that all child nodes also receive the time stamp./fRuns the command without asking for confirmation./addressanswerlimitSpecifies the maximum number of host records that a DNS server can send in response to a query./bindsecondariesChanges the format of the zone transfer so that it can achieve maximum compression and efficiency./bootmethodDetermines the source from which the DNS server gets its configuration information./defaultagingstateDetermines whether the DNS scavenging feature is enabled by default on newly created zones./defaultnorefreshintervalSets a period of time in which no refreshes are accepted for dynamically updated records./defaultrefreshintervalSets a period of time that is allowed for dynamic updates to DNS records./disableautoreversezonesEnables or disables the automatic creation of reverse lookup zones./disablensrecordsautocreationSpecifies whether the DNS server automatically creates name server (NS) resource records for zones that it hosts./dspollingintervalSpecifies in seconds how often the DNS server polls AD DS for changes in the AD integrated zones./dstombstoneintervalThe amount of time in seconds to retain deleted records in AD DS./ednscachetimeoutSpecifies the number of seconds that extended DNS (EDNS) information is cached./enableednsprobesEnables or disables the server to probe other servers to determine if they support EDNS./enablednssecEnables or disables support for DNS Security Extensions (DNSSEC)./enableglobalnamessupportEnables or disables support for the GlobalNames zone./enableglobalqueryblocklistEnables or disables support for the global query block list that blocks name resolution for names in the list./eventloglevelDetermines which events are logged in the DNS server log in Event Viewer./forwarddelegationsDetermines how the DNS server handles a query for a delegated subzone./forwardingtimeoutDetermines how many seconds (0x1-0xFFFFFFFF) a DNS server waits for a forwarder to respond before trying another forwarder./globalneamesqueryorderSpecifies whether the DNS Server service looks first in the GlobalNames zone or local zones when it resolves names./isslaveDetermines how the DNS server responds when queries that it forwards receive no response./localnetpriorityDetermines the order in which host records are returned when the DNS server has multiple host records for the same name./logfilemaxsizeSpecifies the maximum size in bytes (0x10000-0xFFFFFFFF) of the Dns.log file./logfilepathSpecifies the path of the Dns.log file./logipfilterlistSpecifies which packets are logged in the debug log file./loglevelDetermines which types of events are recorded in the Dns.log file./maxcachesizeSpecifies the maximum size, in kilobytes (KB), of the DNS server s memory cache./maxcachettlDetermines how many seconds (0x0-0xFFFFFFFF) a record is saved in the cache./maxnegativecachettlSpecifies how many seconds (0x1-0xFFFFFFFF) an entry that records a negative answer to a query remains stored in the DNS cache./namecheckflagSpecifies which character standard is used when checking DNS names./norecursionDetermines whether a DNS server performs recursive name resolution./notcpThis parameter is obsolete, and it has no effect in current versions of Windows Server./recursionretryDetermines the number of seconds (0x1-0xFFFFFFFF) that a DNS server waits before again trying to contact a remote server./recursiontimeoutDetermines the number of seconds (0x1-0xFFFFFFFF) that a DNS server waits before discontinuing attempts to contact a remote server./roundrobinDetermines the order in which host records are returned when a server has multiple host records for the same name./rpcprotocolSpecifies the protocol that remote procedure call (RPC) uses when it makes a connection from the DNS server./scavengingintervalDetermines whether the scavenging feature for the DNS server is enabled, and sets the number of hours (0x0-0xFFFFFFFF) between scavenging cycles./secureresponsesDetermines whether DNS filters records that are saved in a cache./sendportSpecifies the port number (0x0-0xFFFFFFFF) that DNS uses to send recursive queries to other DNS servers./serverlevelplugindllSpecifies the path of a custom plug-in./strictfileparsingDetermines a DNS server's behavior when it encounters an erroneous record while loading a zone./updateoptionsProhibits dynamic updates of specified types of records./writeauthoritynsDetermines when the DNS server writes name server (NS) resource records in the Authority section of a response./xfrconnecttimeoutDetermines the number of seconds (0x0-0xFFFFFFFF) a primary DNS server waits for a transfer response from its secondary server./agingEnables or disables scavenging in a specific zone./allownsrecordsautocreationOverrides the DNS server's name server (NS) resource record autocreation setting./allowupdateDetermines whether the specified zone accepts dynamic updates./forwarderslaveOverrides the DNS server /isslave setting./forwardertimeoutDetermines how many seconds a DNS zone waits for a forwarder to respond before trying another forwarder./norefreshintervalSets a time interval for a zone during which no refreshes can dynamically update DNS records in a specified zone./refreshintervalSets a time interval for a zone during which refreshes can dynamically update DNS records in a specified zone./securesecondariesDetermines which secondary servers can receive zone updates from the primary server for this zone./forestCreates a DNS directory partition for the forest./alldomainsCreates DNS partitions for all domains in the forest./detailLists all information about the application directory partition./customLists only user-created directory partitions./enumrecordsLists resource records in the specified zone./authorityIncludes authoritative data./glueIncludes glue data./additionalIncludes all additional information about the listed resource records./nodeLists only the resource records of the specified node./childLists only the resource records of a specified child domain./startchildBegins the list at the specified child domain./continueLists only the resource records with their type and data./primaryLists all zones that are either standard primary zones or active directory integrated zones./secondaryLists all standard secondary zones./forwarderLists zones that forward unresolved queries to another DNS server./stubLists all stub zones./cacheLists only the zones that are loaded into the cache./forwardLists forward lookup zones./reverseLists reverse lookup zones./dsLists active directory integrated zones./fileLists zones that are backed by files./domaindirectorypartitionLists zones that are stored in the domain directory partition./forestdirectorypartitionLists zones that are stored in the forest DNS application directory partition./customdirectorypartitionLists all zones that are stored in a user-defined application directory partition./legacydirectorypartitionLists all zones that are stored in the domain directory partition./directorypartitionLists all zones that are stored in the specified directory partition./timeoutSets the number of seconds that the DNS server waits for a response from the forwarder./slavePrevents the DNS server from performing its own iterative queries if the forwarder fails to resolve a query./noslaveAllows the DNS server to perform its own iterative queries if the forwarder fails to resolve a query./domainStores the zone on the domain directory partition./enterpriseStores the zone on the enterprise directory partition./legacyStores the zone on a legacy directory partition./dsdelDeletes the zone from Azure Directory Domain Services (AD DS)./localSets a local master list./noxfrSpecifies that no zone transfers are allowed./nonsecureSpecifies that all zone transfer requests are granted./securensSpecifies that only the server that is listed in the name server (NS) resource record for the zone is granted a transfer./securelistSpecifies that zone transfers are granted only to the list of servers./nonotifySpecifies that no change notifications are sent to secondary servers./notifySpecifies that change notifications are sent to all secondary servers./notifylistSpecifies that change notifications are sent to only the list of servers./overwrite_memOverwrites DNS data from data in AD DS./overwrite_dsOverwrites existing data in AD DS.