Skip to content
Threat Feed

Product

Windows Server

1 brief RSS
high advisory

Abuse of dnscmd.exe to Modify DNS ServerLevelPluginDLL

Attackers can use dnscmd.exe with administrative privileges to configure the Microsoft DNS ServerLevelPluginDll setting, allowing them to load arbitrary DLLs and execute code within the DNS service context for persistence and privilege escalation.

Splunk Enterprise +3 persistence privilege-escalation windows
2r 1t