PowerShell Script Reads Files and Resolves DNS Host Entries

Identifies PowerShell scripts that read files, resolve DNS host entries, and output results to disk.

FreeUnreviewedSigmamediumv1

powershell-script-reads-files-and-resolves-dns-host-entries-fbc5e92f

title: PowerShell Script Reads Files and Resolves DNS Host Entries
id: cbb9d5c2-9b4d-4fc1-ae6d-4eb496383820
status: test
description: This rule flags PowerShell script content that reads files, iterates over items with a foreach loop, resolves DNS host entries via [System.Net.Dns]::GetHostEntry, and writes results to a file. Such behavior can support discovery and collection of network-related information for later exfiltration or targeting. It relies on Windows PowerShell script block text telemetry matching the specific command strings used for file handling, DNS resolution, and output.
references:
  - https://www.fortypoundhead.com/showcontent.asp?artid=24022
  - https://labs.withsecure.com/publications/fin7-target-veeam-servers
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_resolve_list_of_ip_from_file.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-05
tags:
  - attack.exfiltration
  - attack.t1020
logsource:
  product: windows
  category: ps_script
  definition: bade5735-5ab0-4aa7-a642-a11be0e40872
detection:
  selection:
    ScriptBlockText|contains|all:
      - "Get-content "
      - foreach
      - "[System.Net.Dns]::GetHostEntry"
      - Out-File
  condition: selection
falsepositives:
  - The same functionality can be implemented by admin scripts, correlate with name and creator
level: medium
license: DRL-1.1
related:
  - id: fbc5e92f-3044-4e73-a5c6-1c4359b539de
    type: derived

What it detects

This rule flags PowerShell script content that reads files, iterates over items with a foreach loop, resolves DNS host entries via [System.Net.Dns]::GetHostEntry, and writes results to a file. Such behavior can support discovery and collection of network-related information for later exfiltration or targeting. It relies on Windows PowerShell script block text telemetry matching the specific command strings used for file handling, DNS resolution, and output.

Known false positives

The same functionality can be implemented by admin scripts, correlate with name and creator

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.