while false positives should be unlikely given the uncommon combination of powershell execution and dns txt query responses. due to the nature of script block logging, it is possible that legitimate strings or unrelated commands might all match at once. apply appropriate exclusions for those edge cases.

splunk

Techniques

Sample rules

Windows Powershell Commands from DNS TXT

source: splunk
technicques:

Description

The following analytic detects execution of powershell commands retrieved from a remote DNS TXT query response. The use of the DNS TXT record for C2 is an uncommon method for malware that is resilient due to the need for DNS in normal networking activities. This can ensure that their C2 is not blocked by any firewalls.

Detection logic

`powershell`
EventCode=4104
ScriptBlockText IN ("*resolve-dnsname *", "*nslookup *", "*dig *")
ScriptBlockText IN ("*-Type TXT*", "*type=txt*", "* TXT*")
ScriptBlockText IN ("*. (*", "*IEX*")


| fillnull

| stats count min(_time) as firstTime
              max(_time) as lastTime

by dest signature signature_id
   user_id vendor_product EventID
   Guid Opcode Name
   Path ProcessID ScriptBlockId
   ScriptBlockText


| `security_content_ctime(firstTime)`

| `security_content_ctime(lastTime)`

| `windows_powershell_commands_from_dns_txt_filter`