From 9c840567763d915e84c6a76ecc33403bd48b1d88 Mon Sep 17 00:00:00 2001
From: Florian Roth <venom14@gmail.com>
Date: Mon, 8 May 2017 10:12:56 +0200
Subject: [PATCH] DNS ServerLevelPluginDll Issue Added

https://medium.com/@esnesenon/feature-not-bug-dnsadmin-to-dc-compromise-in-one-line-a0f779b8dc83
(cherry picked from commit 3c36beebb9294e28f10489b6b53d2380181f1be2)
---
 sysmonconfig-export.xml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml
index 43a10d06..8fdc2230 100644
--- a/sysmonconfig-export.xml
+++ b/sysmonconfig-export.xml
@@ -845,6 +845,7 @@
             <!--RunMRU and TypedPaths monitoring to detect potential clickfixing and filefixing attacks-->
 			<TargetObject condition="contains">\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\RunMRU\</TargetObject>
 			<TargetObject condition="contains">\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\TypedPaths\</TargetObject>
+			<TargetObject condition="begin with">HKLM\SYSTEM\CurrentControlSet\services\DNS\Parameters\</TargetObject> <!--Microsoft:Windows:DNS: ServerLevelPluginDll Issue https://medium.com/@esnesenon/feature-not-bug-dnsadmin-to-dc-compromise-in-one-line-a0f779b8dc83 -->
 		</RegistryEvent>
 	</RuleGroup>