DNS Persistence Hunting
FreeDetect and analyze DNS-based persistence mechanisms.
Free · Opens the source repo
What DNS Persistence Hunting does
The DNS Persistence Hunting skill is designed for security professionals who need to investigate and mitigate threats related to DNS-based persistence mechanisms. Attackers often exploit DNS records to establish a foothold that can survive traditional remediation efforts such as credential rotations and endpoint reimaging. This skill provides a structured approach to identifying and analyzing these threats by leveraging passive DNS historical data, DNS audit logs, and zone transfer analysis.
Using the SecurityTrails API, this skill enables users to query historical DNS records to uncover unauthorized changes, dangling CNAME records, and other anomalies that may indicate a compromise. The process begins with establishing a baseline of current DNS records, which is crucial for effective anomaly detection. By comparing these records against historical data, users can identify unauthorized modifications, wildcard DNS entries, and changes in NS delegations that could point to malicious activities.
In addition to detecting anomalies, the skill provides guidance on investigating findings by correlating DNS data with threat intelligence feeds and validating record ownership. The output is a comprehensive JSON report that details identified anomalies, their risk severity, and recommendations for remediation. This structured approach is particularly beneficial for SOC analysts and threat hunters looking to build detection rules or enhance their monitoring capabilities for DNS-related threats.
When to use it
Use this skill when investigating suspected DNS hijacking or subdomain takeover incidents, or when performing threat hunting for persistent DNS record tampering.
When not to use it
This skill is not suitable for real-time monitoring or for environments without access to the necessary DNS audit logs or SecurityTrails API.
What you can build with it
Investigating a Security Incident
Use this skill to analyze DNS records when responding to a suspected DNS hijacking incident.
Building Detection Rules
Leverage the methodologies in this skill to create detection rules for monitoring DNS persistence threats.
Validating Security Coverage
Employ this skill to assess your organization's security monitoring capabilities against DNS-related attack techniques.
How to install DNS Persistence Hunting
View source1. Install with the skills CLI
npx skills add mukul975/anthropic-cybersecurity-skills/hunting-for-dns-based-persistence --agent claude-code2. Or install it manually
Download the skill folder and drop it into ~/.claude/skills/ for all projects, or .claude/skills/ to scope it to one repo. Restart Claude Code so it picks up the new skill.
Anthropic's agentic coding CLI, and the reference implementation of Agent Skills. Drop a skill folder into ~/.claude/skills and Claude Code loads it automatically whenever a task matches the skill's description. Claude Code docs
Inside SKILL.md
Written by mukul975Hunting for DNS-based Persistence
Overview
Attackers establish DNS-based persistence by hijacking DNS records, creating unauthorized subdomains, abusing wildcard DNS entries, or modifying NS delegations to redirect traffic through attacker-controlled infrastructure. These techniques survive credential rotations, endpoint reimaging, and traditional remediation because DNS changes persist independently of compromised hosts. Detection requires passive DNS historical analysis, zone file auditing, and monitoring for unauthorized record modifications. This skill covers hunting methodologies using SecurityTrails passive DNS API, DNS audit logs from Route53/Azure DNS/Cloudflare, and zone transfer analysis.
When to Use
- When investigating security incidents that require hunting for dns based persistence
- When building detection rules or threat hunting queries for this domain
- When SOC analysts need structured procedures for this analysis type
- When validating security monitoring coverage for related attack techniques
Prerequisites
- SecurityTrails API key (free tier provides 50 queries/month)
- Access to DNS provider audit logs (Route53, Azure DNS, Cloudflare, or on-premises DNS)
- Python 3.9+ with requests library
- DNS zone file access or AXFR capability for internal zones
- Historical DNS baseline for comparison
Steps
Step 1: Baseline DNS Records
Export current DNS zone records and establish baseline for all authorized A, AAAA, CNAME, MX, NS, and TXT records.
Step 2: Query Passive DNS History
Use SecurityTrails API to retrieve historical DNS records and identify unauthorized changes, new subdomains, and CNAME records pointing to decommissioned services (dangling CNAMEs).
Step 3: Detect Anomalies
Compare current records against baseline to identify unauthorized modifications, wildcard records that resolve all subdomains, NS delegation changes, and MX record hijacking.
Step 4: Investigate Findings
Correlate DNS anomalies with threat intelligence feeds, check resolution targets against known malicious infrastructure, and validate record ownership.
Expected Output
JSON report listing DNS anomalies with record type, historical changes, risk severity, and remediation recommendations for each finding.
Frequently asked questions about DNS Persistence Hunting
Similar skills
Asset Criticality Scoring for Vulns
Prioritize vulnerabilities based on asset criticality.
Performing Alert Triage with Elastic SIEM
Streamline alert triage processes in Elastic Security.
Active Directory Vulnerability Assessment
Secure your Active Directory with comprehensive assessments.
Active Directory Investigation
Streamline your Active Directory compromise investigations.
Parsing Artifacts with Eric Zimmerman Tools
Efficiently parse Windows forensic artifacts for analysis.
Operationalizing MISP Threat Feeds
Enhance threat detection with curated MISP feeds.