PowerShell Add-DnsClientNrptRule Modifies NRPT Namespaces
Flags PowerShell scripts that add DNS Name Resolution Policy Table rules for a specified namespace.
- Product
- windows
- Category
- ps_script
- Author
- Borna Talebi (SigmaHQ), DRL 1.1
- Published
- 2021-09-14
- Updated
- 2026-07-31
ATT&CK techniques
ImpactRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
Detects PowerShell scripts that call Add-DnsClientNrptRule with parameters for modifying a DNS namespace (e.g., -Namesp and -NameSe). Changing the NRPT can redirect DNS resolution away from the default DNS server, which can affect name lookups for targeted domains. The detection relies on Script Block Logging content containing the relevant cmdlet name and namespace-related parameters.
Reporting behind it
- twitter.comhttps://twitter.com/NathanMcNulty/status/1569497348841287681
- learn.microsoft.comhttps://learn.microsoft.com/en-us/powershell/module/dnsclient/add-dnsclientnrptrule?view=windowsserver2022-ps
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_add_dnsclient_rule.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: PowerShell Add-DnsClientNrptRule Modifies NRPT Namespaces
id: 802b79b8-8371-4b42-8555-c6d8d718b110
status: test
description: Detects PowerShell scripts that call Add-DnsClientNrptRule with parameters for modifying a DNS namespace (e.g., -Namesp and -NameSe). Changing the NRPT can redirect DNS resolution away from the default DNS server, which can affect name lookups for targeted domains. The detection relies on Script Block Logging content containing the relevant cmdlet name and namespace-related parameters.
references:
- https://twitter.com/NathanMcNulty/status/1569497348841287681
- https://learn.microsoft.com/en-us/powershell/module/dnsclient/add-dnsclientnrptrule?view=windowsserver2022-ps
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_add_dnsclient_rule.yml
author: Borna Talebi, Huntrule Team
date: 2021-09-14
modified: 2022-10-09
tags:
- attack.impact
- attack.t1565
logsource:
product: windows
category: ps_script
definition: "Requirements: Script Block Logging must be enabled"
detection:
selection:
ScriptBlockText|contains|all:
- Add-DnsClientNrptRule
- -Namesp
- -NameSe
condition: selection
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 4368354e-1797-463c-bc39-a309effbe8d7
type: derived