Find Non-standard DNS Settings for All Computers in Your Network
The DNS information is scanned along with other Windows information during the scan of a Windows asset. During specific targetted attacks on a network, the DNS can be changed in order to reroute users to fake online forms, tricking them into entering credentials. To Detect these types of changes, the report below provides a list of all NICs that do not have specifically mentioned DNS servers set. Read more in our Wifi vulnerability blog.
Before running this report you will need to replace «123.123.123.123» with the IP addresses of the DNS servers you use.
Non-standard DNS Settings Query
Select Top 1000000 tsysOS.Image As icon,
tblAssets.AssetID,
tblAssets.AssetName,
tblAssets.Domain,
tblAssets.Username,
tblAssets.Userdomain,
tblAssets.IPAddress As [Asset IPAddress],
tblNetwork.Description As Adapter,
tblNetwork.IPAddress As [NIC IPAddress],
tblNetwork.IPSubnet,
tblNetwork.DNSServerSearchOrder,
tsysIPLocations.IPLocation,
Case
When tblErrors.ErrorText Is Not Null Or
tblErrors.ErrorText != '' Then
'Scanning Error: ' + tsysasseterrortypes.ErrorMsg
Else ''
End As ScanningErrors,
tblAssets.Lastseen,
tblAssets.Lasttried,
tblNetwork.Lastchanged
From tblAssets
Inner Join tblAssetCustom On tblAssets.AssetID = tblAssetCustom.AssetID
Inner Join tblComputersystem On tblAssets.AssetID = tblComputersystem.AssetID
Inner Join tsysOS On tsysOS.OScode = tblAssets.OScode
Inner Join tsysIPLocations On tsysIPLocations.LocationID =
tblAssets.LocationID
Inner Join tblNetwork On tblAssets.AssetID = tblNetwork.AssetID
Left Join (Select Distinct Top 1000000 tblErrors.AssetID As ID,
Max(tblErrors.Teller) As ErrorID
From tblErrors
Group By tblErrors.AssetID) As ScanningError On tblAssets.AssetID =
ScanningError.ID
Left Join tblErrors On ScanningError.ErrorID = tblErrors.Teller
Left Join tsysasseterrortypes On tsysasseterrortypes.Errortype =
tblErrors.ErrorType
Where tblNetwork.DNSServerSearchOrder Is Not Null And
(tblNetwork.DNSServerSearchOrder Not Like '%123.123.123.123%' Or
tblNetwork.DNSServerSearchOrder Not Like '%123.123.123.123%') And
tblAssetCustom.State = 1 And tblNetwork.IPEnabled = 1
Order By tblAssets.Domain,
tblAssets.AssetName,
Adapter
