PowerShell download cradle using nslookup and TXT/HTTP queries on Windows

title: PowerShell download cradle using nslookup and TXT/HTTP queries on Windows
id: cb106821-262b-44a8-973a-feca27222827
related:
  - id: 1b3b01c7-84e9-4072-86e5-fc285a41ff23
    type: similar
  - id: 999bff6d-dc15-44c9-9f5c-e1051bfc86e1
    type: derived
status: test
description: This rule flags PowerShell execution that builds a download cradle around nslookup to retrieve payload data via DNS TXT queries over HTTP-related strings. Attackers can use DNS to stage or exfiltrate content while blending into common network activity. The detection relies on classic PowerShell script content containing both PowerShell and nslookup markers along with specific nslookup query parameters targeting TXT records.
references:
  - https://twitter.com/Alh4zr3d/status/1566489367232651264
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_classic/posh_pc_abuse_nslookup_with_dns_records.yml
author: Sai Prashanth Pulisetti @pulisettis, Aishwarya Singam, Huntrule Team
date: 2022-12-10
modified: 2025-02-25
tags:
  - attack.execution
  - attack.t1059.001
logsource:
  product: windows
  category: ps_classic_start
detection:
  selection:
    Data|contains|all:
      - powershell
      - nslookup
      - "[1]"
    Data|contains:
      - -q=txt http
      - -querytype=txt http
      - -type=txt http
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1