PowerShell DNSExfiltrator via Invoke-DNSExfiltrator with DoH exfil parameters

Detects PowerShell use of Invoke-DNSExfiltrator for DNS/DoH-based exfiltration based on Script Block Logging content.

FreeUnreviewedSigmahighv1

powershell-dnsexfiltrator-via-invoke-dnsexfiltrator-with-doh-exfil-parameters-d59d7842

title: PowerShell DNSExfiltrator via Invoke-DNSExfiltrator with DoH exfil parameters
id: 6f396942-268b-456c-af90-3957f25915f0
status: test
description: This rule flags PowerShell scripts that execute Invoke-DNSExfiltrator and include multiple exfiltration parameters, including a DoH flag. DNS-based exfiltration can hide data transfer within normal-looking DNS/HTTP-over-DNS traffic and reduce visibility for standard file-transfer monitoring. The detection relies on PowerShell Script Block Logging telemetry by matching specific command and parameter strings in ScriptBlockText.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1048/T1048.md#atomic-test-3---dnsexfiltration-doh
  - https://github.com/Arno0x/DNSExfiltrator
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_invoke_dnsexfiltration.yml
author: frack113, Huntrule Team
date: 2022-01-07
tags:
  - attack.exfiltration
  - attack.t1048
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection_cmdlet:
    - ScriptBlockText|contains: Invoke-DNSExfiltrator
    - ScriptBlockText|contains|all:
        - " -i "
        - " -d "
        - " -p "
        - " -doh "
        - " -t "
  condition: selection_cmdlet
falsepositives:
  - Legitimate script
level: high
license: DRL-1.1
related:
  - id: d59d7842-9a21-4bc6-ba98-64bfe0091355
    type: derived

What it detects

This rule flags PowerShell scripts that execute Invoke-DNSExfiltrator and include multiple exfiltration parameters, including a DoH flag. DNS-based exfiltration can hide data transfer within normal-looking DNS/HTTP-over-DNS traffic and reduce visibility for standard file-transfer monitoring. The detection relies on PowerShell Script Block Logging telemetry by matching specific command and parameter strings in ScriptBlockText.

Known false positives

Legitimate script

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.