huntrule

DNS TXT Responses Containing Command Execution Strings (PowerShell/Windows)

Alerts on DNS TXT answers containing IEX/Invoke-Expression or cmd.exe strings indicative of execution-oriented payloads.

FreeUnreviewedSigmahighv1
title: DNS TXT Responses Containing Command Execution Strings (PowerShell/Windows)
id: e96f3522-1a4e-4b7f-8462-00f2fdfc03fa
status: test
description: This rule flags DNS responses where TXT answers include strings associated with command execution, such as PowerShell invocation (IEX, Invoke-Expression) or Windows command interpreter (cmd.exe). Attackers can embed executable or execution-oriented text in DNS TXT records to blend C2 traffic with normal DNS activity. The detection relies on DNS query/response telemetry, specifically DNS record type and substring matches within the TXT answer content.
references:
  - https://twitter.com/stvemillertime/status/1024707932447854592
  - https://github.com/samratashok/nishang/blob/414ee1104526d7057f9adaeee196d91ae447283e/Backdoors/DNS_TXT_Pwnage.ps1
  - https://github.com/SigmaHQ/sigma/blob/master/rules/network/dns/net_dns_susp_txt_exec_strings.yml
author: Markus Neis, Huntrule Team
date: 2018-08-08
modified: 2021-11-27
tags:
  - attack.command-and-control
  - attack.t1071.004
logsource:
  category: dns
detection:
  selection:
    record_type: TXT
    answer|contains:
      - IEX
      - Invoke-Expression
      - cmd.exe
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 8ae51330-899c-4641-8125-e39f2e07da72
    type: derived

What it detects

This rule flags DNS responses where TXT answers include strings associated with command execution, such as PowerShell invocation (IEX, Invoke-Expression) or Windows command interpreter (cmd.exe). Attackers can embed executable or execution-oriented text in DNS TXT records to blend C2 traffic with normal DNS activity. The detection relies on DNS query/response telemetry, specifically DNS record type and substring matches within the TXT answer content.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.