DNS TXT Answer with Possible Execution Strings

Title: DNS TXT Answer with Possible Execution Strings
Status: test
Description:Detects strings used in command execution in DNS TXT Answer
References:
  -https://twitter.com/stvemillertime/status/1024707932447854592
  -https://github.com/samratashok/nishang/blob/414ee1104526d7057f9adaeee196d91ae447283e/Backdoors/DNS_TXT_Pwnage.ps1
Author: Markus Neis
Date: 2018-08-08
modified:2021-11-27
Tags:

• -'attack.command-and-control'
• -'attack.t1071.004'

Logsource:

• category: dns

Detection:
  selection:
    record_type: 'TXT'
    answer|contains:
      -'IEX'
      -'Invoke-Expression'
      -'cmd.exe'

  condition:selection
Falsepositives:
  -Unknown
Level: high