New DNS ServerLevelPluginDll Installed Via Dnscmd.EXE (f63b56ee-3f79-4b8a-97fb-5c48007e8573)

Detects the installation of a DNS plugin DLL via ServerLevelPluginDll parameter in registry, which can be used to execute code in context of the DNS server (restart required)

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
New DNS ServerLevelPluginDll Installed Via Dnscmd.EXE (f63b56ee-3f79-4b8a-97fb-5c48007e8573)	Sigma-Rules	Modify Registry - T1112 (57340c81-c025-4189-8fa0-fc7ede51bae4)	Attack Pattern	1
New DNS ServerLevelPluginDll Installed Via Dnscmd.EXE (f63b56ee-3f79-4b8a-97fb-5c48007e8573)	Sigma-Rules	DLL Side-Loading - T1574.002 (e64c62cf-9cd7-4a14-94ec-cdaac43ab44b)	Attack Pattern	1
Hijack Execution Flow - T1574 (aedfca76-3b30-4866-b2aa-0f1d7fd1e4b6)	Attack Pattern	DLL Side-Loading - T1574.002 (e64c62cf-9cd7-4a14-94ec-cdaac43ab44b)	Attack Pattern	2