{"id":"999bff6d-dc15-44c9-9f5c-e1051bfc86e1","title":"Nslookup PowerShell Download Cradle","description":"Detects a powershell download cradle using nslookup. This cradle uses nslookup to extract payloads from DNS records.","author":"Sai Prashanth Pulisetti @pulisettis, Aishwarya Singam","status":"test","level":"medium","date":"2022-12-10","modified":"2025-02-25","tags":["attack.execution","attack.t1059.001"],"technique_ids":["T1059.001"],"logsource":{"product":"windows","category":"ps_classic_start"},"falsepositives":["Unknown"],"references":["https://twitter.com/Alh4zr3d/status/1566489367232651264"],"source_path":"rules/windows/powershell/powershell_classic/posh_pc_abuse_nslookup_with_dns_records.yml","source_sha256":"201b6e3b5f27ac58c64664bd3819c9146b5debce9ab7da63ccfb46add0bf252e","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/powershell/powershell_classic/posh_pc_abuse_nslookup_with_dns_records.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Nslookup PowerShell Download Cradle\nid: 999bff6d-dc15-44c9-9f5c-e1051bfc86e1\nrelated:\n    - id: 1b3b01c7-84e9-4072-86e5-fc285a41ff23\n      type: similar\nstatus: test\ndescription: Detects a powershell download cradle using nslookup. This cradle uses nslookup to extract payloads from DNS records.\nreferences:\n    - https://twitter.com/Alh4zr3d/status/1566489367232651264\nauthor: Sai Prashanth Pulisetti @pulisettis, Aishwarya Singam\ndate: 2022-12-10\nmodified: 2025-02-25\ntags:\n    - attack.execution\n    - attack.t1059.001\nlogsource:\n    product: windows\n    category: ps_classic_start\ndetection:\n    selection:\n        Data|contains|all:\n            - 'powershell'\n            - 'nslookup'\n            - '[1]'\n        Data|contains:\n            - '-q=txt http'\n            - '-querytype=txt http'\n            - '-type=txt http'\n    condition: selection\nfalsepositives:\n    - Unknown\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1059.001","id":"T1059.001","name":"PowerShell","page":"techniques/enterprise/T1059.001/"}],"data_path":"data/detection-rules/999bff6d-dc15-44c9-9f5c-e1051bfc86e1.json","kind":"sigma"}