PowerShell Script Reading Files and Resolving DNS Host Entries
Identifies PowerShell scripts that read files, resolve DNS host entries, and output results to disk.
- Product
- windows
- Category
- ps_script
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-05-05
- Updated
- 2026-07-31
ATT&CK techniques
ExfiltrationRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies PowerShell script content that reads files, iterates over items, resolves DNS host entries via .NET, and writes results to a file. Attackers can use this combination to map hostnames to network information and stage data for further collection or exfiltration. Detection relies on PowerShell ScriptBlockText containing the specific strings for Get-content, foreach, [System.Net.Dns]::GetHostEntry, and Out-File.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: PowerShell Script Reading Files and Resolving DNS Host Entries
id: cbb9d5c2-9b4d-4fc1-ae6d-4eb496383820
status: test
description: This rule identifies PowerShell script content that reads files, iterates over items, resolves DNS host entries via .NET, and writes results to a file. Attackers can use this combination to map hostnames to network information and stage data for further collection or exfiltration. Detection relies on PowerShell ScriptBlockText containing the specific strings for Get-content, foreach, [System.Net.Dns]::GetHostEntry, and Out-File.
references:
- https://www.fortypoundhead.com/showcontent.asp?artid=24022
- https://labs.withsecure.com/publications/fin7-target-veeam-servers
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_resolve_list_of_ip_from_file.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-05
tags:
- attack.exfiltration
- attack.t1020
logsource:
product: windows
category: ps_script
definition: bade5735-5ab0-4aa7-a642-a11be0e40872
detection:
selection:
ScriptBlockText|contains|all:
- "Get-content "
- foreach
- "[System.Net.Dns]::GetHostEntry"
- Out-File
condition: selection
falsepositives:
- The same functionality can be implemented by admin scripts, correlate with name and creator
level: medium
license: DRL-1.1
related:
- id: fbc5e92f-3044-4e73-a5c6-1c4359b539de
type: derived