Subdomain Permutation — Reconnaissance Detection
The passive half of this technique is undetectable, which means detection is the wrong place to spend effort. The winning move is to run the same enumeration against yourself on a schedule and fix what it finds before someone else runs it.
Open in Red Team Toolkit — subdomainSubdomain Permutation — Reconnaissance Detection
The passive half of this technique is undetectable, which means detection is the wrong place to spend effort. The winning move is to run the same enumeration against yourself on a schedule and fix what it finds before someone else runs it.
Telemetry generated
| Log source | Field / identifier | What it shows |
|---|---|---|
| Authoritative DNS Query Log | query_name / response_code | NXDOMAIN bursts from a single source against your authoritative nameserver are the only active-brute-force signal. Generating the permutation list and validating it against Certificate Transparency logs or passive DNS never touches your infrastructure and produces no log entry here. |
| Certificate Transparency Log | certificate SAN entries | A defensive feed, not an attack indicator. Every certificate issued for your domains is publicly logged. CT monitoring lets you discover subdomains an attacker found passively — and subdomains you forgot you had. This is the most important telemetry source for this technique. |
| External Attack Surface Management (ASM) | asset inventory diff | Continuous ASM scanning discovers live hosts on your IP ranges and DNS zones. A newly discovered host that is not in your approved-asset inventory is a shadow IT finding — frequently the first sign anyone remembers a forgotten staging environment exists. |
| First-Touch Web / TLS Log | first_seen timestamp | The first HTTP or TLS connection to a discovered subdomain from an external source. Often the earliest indicator that a forgotten host is being actively probed after passive discovery. |
Detection rules
title: Subdomain Enumeration — NXDOMAIN Burst per Source
id: a7b8c9d0-e1f2-3456-abcd-567890123456
status: experimental
description: >
Counts distinct NXDOMAIN responses per source over 10 minutes. Only active
DNS brute-forcing is detectable this way. Passive validation via Certificate
Transparency and passive DNS databases is genuinely invisible — see the CT
self-monitoring logic block for the countermeasure that actually matters.
logsource:
product: dns
category: dns
detection:
selection:
dns.response_code: NXDOMAIN
timeframe: 10m
condition: selection | count(dns.query.name) by source.ip > 100
falsepositives:
- Misconfigured internal resolvers generating NXDOMAIN storms
- Legitimate bulk DNS tooling during authorised asset discovery
level: medium
tags:
- attack.reconnaissance
- attack.t1595.002Evasion & counters
Passive validation via CT logs and passive DNS databases — never touches the target, produces no DNS query.
There is no detection for this — it is genuinely invisible to your infrastructure. The countermeasure is your own CT monitoring and ASM: know your exposure before the attacker maps it.
Distributing queries across public resolvers (8.8.8.8, 1.1.1.1, etc.) so no single source exceeds the NXDOMAIN threshold.
Aggregate by queried parent domain rather than by source IP. A burst of NXDOMAIN responses for *.example.com from 50 different source IPs is still enumeration — the signal is in the destination pattern, not the source.
Slow enumeration spread over hours or days to stay below per-window thresholds.
Extend detection windows to hours or days as a scheduled hunt using cumulative distinct-NXDOMAIN counts. And again: know your own inventory — slow enumeration finds the same forgotten staging hosts a fast scan does.
Rule tuning
Preventive control
Maintain an accurate external asset inventory and decommission unused DNS records — a subdomain that does not exist cannot be discovered. Monitor CT logs continuously so you find forgotten assets before an attacker does. Ensure non-production environments are not publicly resolvable, or if they must be, gate them behind authentication so discovery does not immediately lead to access.