Suspicious Nslookup PowerShell Download Cradle - ProcessCreation (via process_creation)

title: Suspicious Nslookup PowerShell Download Cradle - ProcessCreation (via process_creation)
id: 08be076c-bbed-555d-b3c7-41ee2918b80f
status: stable
description: This rule detects anomalous powershell download cradle using nslookup. This cradle uses nslookup to extract payloads from DNS records
references:
    - https://twitter.com/Alh4zr3d/status/1566489367232651264
author: Huntrule Team
date: 2026-01-10
tags:
    - attack.stealth
    - attack.command-and-control
    - attack.execution
    - attack.t1071.004
    - attack.t1059.001
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|contains: '\nslookup.exe'
        - OriginalFileName: '\nslookup.exe'
    selection_cmd:
        ParentImage|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
        CommandLine|contains:
            - ' -q=txt '
            - ' -querytype=txt '
    condition: all of selection_*
falsepositives:
    - Unknown
level: medium