Nslookup PowerShell Download Cradle

Title: Nslookup PowerShell Download Cradle
Status: test
Description:Detects a powershell download cradle using nslookup. This cradle uses nslookup to extract payloads from DNS records.
References:
  -https://twitter.com/Alh4zr3d/status/1566489367232651264
Author: Sai Prashanth Pulisetti @pulisettis, Aishwarya Singam
Date: 2022-12-10
modified:2025-02-25
Tags:

• -'attack.execution'
• -'attack.t1059.001'

Logsource:

• product: windows
• category: ps_classic_start

Detection:
  selection:
    Data|contains|all:
      -'powershell'
      -'nslookup'
      -'[1]'

    Data|contains:
      -'-q=txt http'
      -'-querytype=txt http'
      -'-type=txt http'

  condition:selection
Falsepositives:
  -Unknown
Level: medium