blog/source/threat-hunting/ad-integrated-dns-zone-expo...

431 B

title layout date
AD integrated DNS zone export page 2025-08-09

References: 1 SPL:

index="windows" source IN ("XmlWinEventLog:Microsoft-Windows-PowerShell/Operational", "XmlWinEventLog:PowerShellCore/Operational") EventCode=4104 ScriptBlockText="*export-dnsserverzone*" ScriptBlockText="*_msdcs*"