Nslookup PowerShell Download Cradle - ProcessCreation

 1title: Nslookup PowerShell Download Cradle - ProcessCreation
 2id: 1b3b01c7-84e9-4072-86e5-fc285a41ff23
 3related:
 4    - id: 72671447-4352-4413-bb91-b85569687135
 5      type: obsoletes
 6    - id: 999bff6d-dc15-44c9-9f5c-e1051bfc86e1
 7      type: similar
 8status: test
 9description: Detects suspicious powershell download cradle using nslookup. This cradle uses nslookup to extract payloads from DNS records
10references:
11    - https://twitter.com/Alh4zr3d/status/1566489367232651264
12author: Nasreddine Bencherchali (Nextron Systems)
13date: 2022/09/05
14modified: 2022/12/19
15tags:
16    - attack.defense_evasion
17logsource:
18    category: process_creation
19    product: windows
20detection:
21    selection_img:
22        - Image|contains: '\nslookup.exe'
23        - OriginalFileName: '\nslookup.exe'
24    selection_cmd:
25        ParentImage|endswith:
26            - '\powershell.exe'
27            - '\pwsh.exe'
28        CommandLine|contains:
29            - ' -q=txt '
30            - ' -querytype=txt '
31    condition: all of selection_*
32falsepositives:
33    - Unknown
34level: medium