Windows PowerShell Download Cradle Using nslookup TXT Queries (Process Creation)

ATT&CK techniques

C2

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
- T1071.004DNS
Exfiltration
Impact

What it detects

Identifies Windows processes where PowerShell (powershell.exe or pwsh.exe) launches a command using nslookup.exe to perform TXT-record queries (e.g., -q=txt / -querytype=txt / -type=txt). This behavior matters because DNS TXT lookups are commonly used to retrieve or stage payload data via command-and-control channels. The detection relies on process creation telemetry, matching the parent process image and the nslookup command-line parameters.

Reporting behind it

Related detections9 linkedT1071.004 — drag to rearrange

Malicious GS-Netcat Command and Control via Global Socket Relay Network (via dns_query)

Suspicious DNS Query to Dynamic DNS and Tunneling Providers Abused by RATs

Suspicious UPSTYLE Command Channel Pattern in Web Requests via CVE-2024-3400

Suspicious DNS C2 to Microsoft Typosquat Domain

Suspicious DNS Queries to Simitor Tracking Tunnel Infrastructure

Suspicious DNS Queries to Secshow Open Resolver Scanning Infrastructure

Suspicious OpenMetadata Exploit Interactsh OAST Callback (via process_creation)

Suspicious Outlook Process Spawning Network Utilities for NotDoor C2 (via process_creation)

Malicious DNS Query To fdmpkg C2 Domain via DNS Query

Windows PowerShell Download Cradle Using nslookup TXT Queries (Process Creation)

Pivot detection · T1071.004 · 9 related

Changelog

v3

v3
Candidate ingested via manual entry.2026-10-14
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-powershell-dns-txt-download-cradle-via-nslookup-process-creation-1b3b01c7

title: Windows PowerShell Download Cradle Using nslookup TXT Queries (Process Creation)
id: f34be208-c22a-4de7-adf2-92b737f3a78a
related:
  - id: 72671447-4352-4413-bb91-b85569687135
    type: obsolete
  - id: 999bff6d-dc15-44c9-9f5c-e1051bfc86e1
    type: similar
  - id: 1b3b01c7-84e9-4072-86e5-fc285a41ff23
    type: derived
status: test
description: Identifies Windows processes where PowerShell (powershell.exe or pwsh.exe) launches a command using nslookup.exe to perform TXT-record queries (e.g., -q=txt / -querytype=txt / -type=txt). This behavior matters because DNS TXT lookups are commonly used to retrieve or stage payload data via command-and-control channels. The detection relies on process creation telemetry, matching the parent process image and the nslookup command-line parameters.
references:
  - https://twitter.com/Alh4zr3d/status/1566489367232651264
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_nslookup_poweshell_download.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-09-05
modified: 2026-10-13
tags:
  - attack.command-and-control
  - attack.t1071.004
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \nslookup.exe
    - OriginalFileName: nslookup.exe
  selection_cmd:
    ParentImage|endswith:
      - \powershell.exe
      - \pwsh.exe
    CommandLine|contains:
      - " -q=txt "
      - " -querytype=txt "
      - " -type=txt"
  condition: all of selection_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL