skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

hunting-for-dns-based-persistence

Detect DNS-based persistence using passive DNS history, zone baselines, and provider audit logs.

954|172|Updated Mar 13, 2026
Search Tags:#persistence#dns#threat hunting#subdomain takeover#passive DNS#securitytrails#dns hijacking
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill hunting-for-dns-based-persistence
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunting-for-dns-based-persistence
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/threat-hunting/hunting-for-dns-based-persistence
Command: npx skills add https://github.com/xalgord/xalgorix --skill hunting-for-dns-based-persistence

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires requests.

What problem does it solve?

Attackers maintain persistence by hijacking DNS records, creating unauthorized subdomains, abusing wildcard entries, or exploiting dangling CNAMEs pointing to deprovisioned cloud resources, and these changes survive credential rotation and host reimaging. This Skill provides a structured hunting methodology to detect such DNS-based persistence before it is abused.

Core Features & Use Cases

  • Baseline and Diff Analysis: Export current zone records and compare against a historical baseline to catch unauthorized A, AAAA, CNAME, MX, NS, and TXT modifications.
  • Passive DNS Investigation: Query the SecurityTrails API for historical records to identify new subdomains, dangling CNAMEs, and NS delegation changes.
  • Audit Log Review: Analyze Route53, Azure DNS, and Cloudflare audit logs for unauthorized zone modifications.
  • Use Case: A SOC analyst investigating a suspected compromise runs this hunt to discover a dangling CNAME pointing to a released S3 bucket, confirming a subdomain takeover risk, and receives a JSON report with severity and remediation steps.

Quick Start

Hunt for DNS-based persistence in my domain by comparing current zone records against the baseline and querying SecurityTrails for dangling CNAMEs and unauthorized changes.

Frequently Asked Questions about hunting-for-dns-based-persistence

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect dangling CNAME records and subdomain takeover?▼

Dangling CNAME detection compares current DNS records against a baseline and queries passive DNS history to find CNAMEs pointing to deprovisioned cloud resources like released S3 buckets or Azure App Services. Validate detection by creating a test CNAME to a released resource and confirming it gets flagged.

How to hunt for DNS-based persistence with SecurityTrails?▼

Use the SecurityTrails passive DNS API to retrieve historical records for your domains, then identify unauthorized changes, new subdomains, and CNAMEs pointing to decommissioned services. The free tier provides 50 queries per month, so prioritize critical zones.

What are the limitations of passive DNS for threat hunting?▼

Passive DNS has sampling gaps and misses fast-flux or short-lived records, so absence in passive DNS is not proof of safety. Additionally, endpoints using DoH or DoT through public resolvers bypass internal DNS logging entirely.

Can this hunt work with Route53, Azure DNS, or Cloudflare?▼

Yes, the methodology uses DNS provider audit logs from Route53, Azure DNS, and Cloudflare to detect unauthorized record modifications. You also need zone file access or AXFR capability for internal zones plus a historical baseline for comparison.

Why does DNS persistence survive credential rotation and reimaging?▼

DNS records persist independently of compromised hosts because they live in the DNS provider's zone configuration, not on endpoints. NS delegation hijacks and unauthorized records remain active even after credentials are rotated or machines are reimaged.

Related Skills

Explore More Software Engineering Skills→
bughqbughq
2

stacks-dns

Manage AWS Route53 hosted zones and DNS records for Stacks applications.

Official
Intermediate
NCLGISANCLGISA

nextdns-api

Manage NextDNS protective DNS profiles via the REST API.

Official
Intermediate
KarlinskySKarlinskyS

domain-intel

Perform passive domain intelligence using only Python stdlib.

Community
Intermediate
jaskaranhundaljaskaranhundal
3

threat-hunting

Execute hypothesis-driven, IOC-driven, and anomaly-driven threat hunting across endpoint, network, and cloud telemetry.

Community
Advanced