act as DNS server plugin DLL

rule:
  meta:
    name: act as DNS server plugin DLL
    namespace: persistence
    authors:
      - jakub.jozwiak@mandiant.com
    scopes:
      static: file
      dynamic: file
    att&ck:
      - Persistence::Server Software Component [T1505]
    references:
      - https://medium.com/@esnesenon/feature-not-bug-dnsadmin-to-dc-compromise-in-one-line-a0f779b8dc83
    examples:
      - 36f506a34b99bf4c199b3c9ec8aa02bd631feafdca20e69e33e714c269ddb8c5
  features:
    - or:
      - export: DnsPluginInitialize
      - export: DnsPluginCleanup
      - export: DnsPluginQuery