Sigma rule: DNSCat2 Powershell Implementation Detection Via Process Creation

Rule

Title

DNSCat2 Powershell Implementation Detection Via Process Creation

Status

unsupported

Level

high

Author

Cian Heasley

Date

2020/08/08

Modified

2023/02/24

File

unsupported/windows/proc_creation_win_correlation_dnscat2_powershell_implementation.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

The PowerShell implementation of DNSCat2 calls nslookup to craft queries. Counting nslookup processes spawned by PowerShell will show hundreds or thousands of instances if PS DNSCat2 is active locally.

Log source

product

windows

category

process_creation

Detection

selection:
    ParentImage|endswith:
        - '\powershell.exe'
        - '\pwsh.exe'
    Image|endswith: '\nslookup.exe'
    CommandLine|endswith: '\nslookup.exe'
condition: selection | count(Image) by ParentImage > 100

False positives (as the rule lists them)

• Other powershell scripts that call nslookup.exe

Tags

• attack.command_and_control
• attack.t1071
• attack.t1071.004
• attack.t1001.003
• attack.t1041

MITRE ATT&CK ids this rule names

• T1001.003
• T1041
• T1071
• T1071.004

References

• https://github.com/lukebaggett/dnscat2-powershell
• https://blu3-team.blogspot.com/2019/08/powershell-dns-c2-notes.html
• https://ragged-lab.blogspot.com/2020/06/it-is-always-dns-powershell-edition.html

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/unsupported/windows/proc_creation_win_correlation_dnscat2_powershell_implementation.yml