Windows PowerShell: Silence EmpireDNSAgent script matches DNS tunnel and remote shutdown/restart activity

Flags PowerShell ScriptBlockText that combines Empire process-control indicators with dnscat DNS tunneling commands.

FreeReviewedSigma · Critical · v2

Product: windows
Category: ps_script
Author: Alina Stepchenkova, Group-IB, oscd.community (SigmaHQ), DRL 1.1
Published: 2019-11-01
Updated: 2026-07-31

ATT&CK techniques

Execution → Impact

Recon
Resource Dev
Initial Access
Execution
- T1059.001PowerShell
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
- T1071.004DNS
- T1572Protocol Tunneling
Exfiltration
Impact
- T1529System Shutdown/Reboot

What it detects

This rule flags PowerShell script block logging where the script contains both Empire-like process control indicators (e.g., Stop-Computer/Restart-Computer and exception handling) and DNS tunneling behavior associated with Dnscat2 (including nslookup command execution and specific tunnel/session fields). The combined pattern matters because it can indicate coordinated remote command/control and host impact using a DNS-based channel. It relies on Windows PowerShell Script Block Logging telemetry to capture ScriptBlockText content for matching.

Reporting behind it

Related detections9 linkedT1059.001 — drag to rearrange

Suspicious Script Download via Curl and PowerShell by Dohdoor

Malicious dnscat2 DNS Tunneling C2 Traffic

Suspicious Script Host Spawning Hidden PowerShell (via process_creation)

Suspicious VS Code Tunnel Establishment for Covert Access (via process_creation)

Suspicious PowerShell Reflective Assembly Load With GZip Decompression (via process_creation)

Suspicious PowerShell Invoke-Expression with Replace Obfuscation

Suspicious PowerShell Archive Extraction to AppData Roaming

Malicious PowerShell Spawned by Masqueraded NVIDIA GeForce Experience Binary

Suspicious PowerShell Hidden Unrestricted Execution via ClickFix

Windows PowerShell: Silence EmpireDNSAgent script matches DNS tunnel and remote shutdown/restart activity

Pivot detection · T1059.001 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-powershell-detect-silence-empire-eda-execution-and-dns-tunneling-script--3ceb2083

title: "Windows PowerShell: Silence EmpireDNSAgent script matches DNS tunnel and remote shutdown/restart activity"
id: 4b3cdd2c-db7a-492c-a439-8e5e45e19f2c
status: test
description: This rule flags PowerShell script block logging where the script contains both Empire-like process control indicators (e.g., Stop-Computer/Restart-Computer and exception handling) and DNS tunneling behavior associated with Dnscat2 (including nslookup command execution and specific tunnel/session fields). The combined pattern matters because it can indicate coordinated remote command/control and host impact using a DNS-based channel. It relies on Windows PowerShell Script Block Logging telemetry to capture ScriptBlockText content for matching.
references:
  - https://www.group-ib.com/resources/threat-research/silence_2.0.going_global.pdf
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_apt_silence_eda.yml
author: Alina Stepchenkova, Group-IB, oscd.community, Huntrule Team
date: 2019-11-01
modified: 2023-04-03
tags:
  - attack.execution
  - attack.t1059.001
  - attack.command-and-control
  - attack.t1071.004
  - attack.t1572
  - attack.impact
  - attack.t1529
  - attack.g0091
  - attack.s0363
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  empire:
    ScriptBlockText|contains|all:
      - System.Diagnostics.Process
      - Stop-Computer
      - Restart-Computer
      - Exception in execution
      - $cmdargs
      - Close-Dnscat2Tunnel
  dnscat:
    ScriptBlockText|contains|all:
      - set type=$LookupType`nserver
      - $Command | nslookup 2>&1 | Out-String
      - New-RandomDNSField
      - "[Convert]::ToString($SYNOptions, 16)"
      - $Session.Dead = $True
      - $Session["Driver"] -eq
  condition: empire and dnscat
falsepositives:
  - Unknown
level: critical
license: DRL-1.1
related:
  - id: 3ceb2083-a27f-449a-be33-14ec1b7cc973
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL