Powershell Add Name Resolution Policy Table Rule

Title: Powershell Add Name Resolution Policy Table Rule
Status: test
Description:Detects powershell scripts that adds a Name Resolution Policy Table (NRPT) rule for the specified namespace. This will bypass the default DNS server and uses a specified server for answering the query.
References:
  -https://twitter.com/NathanMcNulty/status/1569497348841287681
  -https://learn.microsoft.com/en-us/powershell/module/dnsclient/add-dnsclientnrptrule?view=windowsserver2022-ps
Author: Borna Talebi
Date: 2021-09-14
modified:2022-10-09
Tags:

• -'attack.impact'
• -'attack.t1565'

Logsource:

• product: windows
• category: ps_script
• definition: Requirements: Script Block Logging must be enabled

Detection:
  selection:
    ScriptBlockText|contains|all:
      -'Add-DnsClientNrptRule'
      -'-Namesp'
      -'-NameSe'

  condition:selection
Falsepositives:
  -Unknown
Level: high