Nslookup PowerShell Download Cradle - ProcessCreation

calendar Oct 14, 2026 · attack.command-and-control attack.t1071.004  ·
Share on: linkedin copy

Detects suspicious powershell download cradle using nslookup. This cradle uses nslookup to extract payloads from DNS records

Sigma rule (View on GitHub)

 1title: Nslookup PowerShell Download Cradle - ProcessCreation
 2id: 1b3b01c7-84e9-4072-86e5-fc285a41ff23
 3related:
 4    - id: 72671447-4352-4413-bb91-b85569687135
 5      type: obsolete
 6    - id: 999bff6d-dc15-44c9-9f5c-e1051bfc86e1
 7      type: similar
 8status: test
 9description: |
10    Detects suspicious powershell download cradle using nslookup.
11    This cradle uses nslookup to extract payloads from DNS records    
12references:
13    - https://twitter.com/Alh4zr3d/status/1566489367232651264
14author: Nasreddine Bencherchali (Nextron Systems)
15date: 2022-09-05
16modified: 2026-10-13
17tags:
18    - attack.command-and-control
19    - attack.t1071.004
20logsource:
21    category: process_creation
22    product: windows
23detection:
24    selection_img:
25        - Image|endswith: '\nslookup.exe'
26        - OriginalFileName: 'nslookup.exe'
27    selection_cmd:
28        ParentImage|endswith:
29            - '\powershell.exe'
30            - '\pwsh.exe'
31        CommandLine|contains:
32            - ' -q=txt '
33            - ' -querytype=txt '
34            - ' -type=txt'
35    condition: all of selection_*
36falsepositives:
37    - Unknown
38level: medium

References

Related rules

to-top