PowerShell Add-DnsClientNrptRule Changes NRPT Namespace

title: PowerShell Add-DnsClientNrptRule Changes NRPT Namespace
id: 802b79b8-8371-4b42-8555-c6d8d718b110
status: test
description: This rule identifies PowerShell script content that calls Add-DnsClientNrptRule with parameters for a specific namespace. Changing the NRPT can steer name resolution away from default DNS behavior and direct queries to an attacker-controlled or non-standard DNS server. It relies on script block logging telemetry capturing the PowerShell script text and matching the presence of the Add-DnsClientNrptRule command along with the relevant namespace and name server parameters.
references:
  - https://twitter.com/NathanMcNulty/status/1569497348841287681
  - https://learn.microsoft.com/en-us/powershell/module/dnsclient/add-dnsclientnrptrule?view=windowsserver2022-ps
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_add_dnsclient_rule.yml
author: Borna Talebi, Huntrule Team
date: 2021-09-14
modified: 2022-10-09
tags:
  - attack.impact
  - attack.t1565
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection:
    ScriptBlockText|contains|all:
      - Add-DnsClientNrptRule
      - -Namesp
      - -NameSe
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 4368354e-1797-463c-bc39-a309effbe8d7
    type: derived