Detection rules › Sigma

Nslookup PowerShell Download Cradle

Severity
medium
Author
Sai Prashanth Pulisetti @pulisettis, Aishwarya Singam
Source
upstream

Detects a powershell download cradle using nslookup. This cradle uses nslookup to extract payloads from DNS records.

MITRE ATT&CK coverage

TacticTechniques
ExecutionT1059.001 Command and Scripting Interpreter: PowerShell

Event coverage

ProviderEvent IDTitle
PowerShell400

Stages and Predicates

Stage 1: selection

or:
Data|contains: '-q=txt http'
Data|contains: '-querytype=txt http'
Data|contains: '-type=txt http'
Data|contains: '[1]'
Data|contains: nslookup
Data|contains: powershell

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
Datamatch
  • -q=txt http
  • -querytype=txt http
  • -type=txt http
  • [1]
  • nslookup
  • powershell