# dns-sd

> Discover local network services using the DNS-Based Service Discovery (SD) protocol.

dns-sd can be used to interact with the Multicast DNS (mDNS) and DNS Service Discovery (DNS-SD) protocols. The tool is useful for administrators but can also be abused by malicious actors to discover local network services.

- Page: https://loobins.io/binaries/dns-sd/
- Author: Brendan Chamberlain (@infosecB)
- Created: 2023-05-19
- Tactics: Discovery

## Paths

- `/usr/bin/dns-sd`

## Example Use Cases

### Discover SSH hosts

Hosts serving SSH can be discovered using the _ssh._tcp service string.

```bash
dns-sd -B _ssh._tcp
```

- Tactics: Discovery
- Tags: network

### Discover web hosts

Hosts serving web services can be discovered using the _http._tcp service string.

```bash
dns-sd -B _http._tcp
```

- Tactics: Discovery
- Tags: network

### Discover hosts serving remote screen sharing

Hosts serving remote screen sharing can be discovered using the _rfb._tcp service string.

```bash
dns-sd -B _rfb._tcp
```

- Tactics: Discovery
- Tags: network

### Discover hosts serving SMB

Hosts serving SMB can be discovered using the _smb._tcp service string.

```bash
dns-sd -B _smb._tcp
```

- Tactics: Discovery
- Tags: network

## Detections

- [Jamf Protect: Detect dns-sd discovery activity](https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/dns_service_discovery)

## Resources

- [What does APT Activity Look Like on macOS?](https://themittenmac.com/what-does-apt-activity-look-like-on-macos)
- [mDNS / Bonjour Bible - List of Common Service Strings for various vendors](https://jonathanmumm.com/tech-it/mdns-bonjour-bible-common-service-strings-for-various-vendors/)

## Acknowledgements

- Chris Ross, Cedric Owens: Farming The Apple Orchards: Living Off The Land Techniques