CVE coverage
View on NVD →
CVE-2020-1350
CVSS 10.0
Actively exploited (KEV)
9 detections found
A remote code execution vulnerability exists in Windows Domain Name System servers when they fail to properly handle requests, aka 'Windows DNS Server Remote Code Execution Vulnerability'.
Detection rules
| Source | Rule | Status | Updated |
|---|---|---|---|
| elastic | Unusual Child Process of dns.exe | production | 2026-10-09 |
| elastic | Abnormally Large DNS Response | production | 2026-09-18 |
| elastic | Unusual File Operation by dns.exe | production | 2026-09-18 |
| splunk | Detect Windows DNS SIGRed via Splunk Stream | experimental | 2026-05-13 |
| splunk | Detect Windows DNS SIGRed via Zeek | experimental | 2026-05-13 |
| sigma | Unusual File Deletion by Dns.exe | test | 2023-02-15 |
| sigma | Unusual Child Process of dns.exe | test | 2023-02-05 |
| sigma | Unusual File Modification by dns.exe | test | 2022-09-27 |
| sigma | DNS RCE CVE-2020-1350 | test | 2022-07-12 |