Suspicious Nslookup PowerShell Download Cradle (via ps_classic_start)

title: Suspicious Nslookup PowerShell Download Cradle (via ps_classic_start)
id: 49d5195c-dd3b-567c-b15a-9c8fe1c7f7d9
status: stable
description: This rule detects a powershell download cradle using nslookup. This cradle uses nslookup to extract payloads from DNS records.
references:
    - https://attack.mitre.org/techniques/T1059/001/
    - https://twitter.com/Alh4zr3d/status/1566489367232651264
author: Huntrule Team
date: 2026-03-30
tags:
    - attack.execution
    - attack.t1059.001
logsource:
    product: windows
    category: ps_classic_start
detection:
    selection:
        Data|contains|all:
            - 'powershell'
            - 'nslookup'
            - '[1]'
        Data|contains:
            - '-q=txt http'
            - '-querytype=txt http'
            - '-type=txt http'
    condition: selection
falsepositives:
    - Unknown
level: medium