huntrule

PowerShell Script Reading Files and Resolving DNS Host Entries

Identifies PowerShell scripts that read files, resolve DNS host entries, and output results to disk.

FreeReviewedSigma · Medium · v2
Product
windows
Category
ps_script
Author
Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2023-05-05
Updated
2026-07-31
AnalysisDetection
title: PowerShell Script Reading Files and Resolving DNS Host Entries
id: cbb9d5c2-9b4d-4fc1-ae6d-4eb496383820
status: test
description: This rule identifies PowerShell script content that reads files, iterates over items, resolves DNS host entries via .NET, and writes results to a file. Attackers can use this combination to map hostnames to network information and stage data for further collection or exfiltration. Detection relies on PowerShell ScriptBlockText containing the specific strings for Get-content, foreach, [System.Net.Dns]::GetHostEntry, and Out-File.
references:
  - https://www.fortypoundhead.com/showcontent.asp?artid=24022
  - https://labs.withsecure.com/publications/fin7-target-veeam-servers
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_resolve_list_of_ip_from_file.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-05
tags:
  - attack.exfiltration
  - attack.t1020
logsource:
  product: windows
  category: ps_script
  definition: bade5735-5ab0-4aa7-a642-a11be0e40872
detection:
  selection:
    ScriptBlockText|contains|all:
      - "Get-content "
      - foreach
      - "[System.Net.Dns]::GetHostEntry"
      - Out-File
  condition: selection
falsepositives:
  - The same functionality can be implemented by admin scripts, correlate with name and creator
level: medium
license: DRL-1.1
related:
  - id: fbc5e92f-3044-4e73-a5c6-1c4359b539de
    type: derived