Parse Ntds DnsNode dnsRecord entries

[william-billaud]

DnsNode (https://learn.microsoft.com/en-gb/windows/win32/adschema/c-dnsnode) object contains DNS records.

Dns records are stored as binary blob in the dnsRecord property and must be parsed in order to extract DNS records.

Forensics interest is mainly to identify some DNS records related to threat actor activity (fake dns configured by TA, or PTR records showing hostnames of unusual machine) and getting an hostname <-> IP list.

References :

• https://blog.fox-it.com/2019/04/25/getting-in-the-zone-dumping-active-directory-dns-using-adidnsdump/
• https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/active-directory-integrated-dns-zones
• https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dnsp/6912b338-5472-4f59-b912-0edb536b6ed8
• https://github.com/dirkjanm/adidnsdump/blob/master/adidnsdump/dnsdump.py