Name:Windows Powershell Commands from DNS TXT id:b61353cd-5b09-4699-8b86-6517a9038043 version:1 date:None author:Raven Tait, Splunk status:production type:Anomaly Description:The following analytic detects execution of powershell commands retrieved from a remote DNS TXT query response.
The use of the DNS TXT record for C2 is an uncommon method for malware that is resilient due to the need for DNS in normal networking
activities.
This can ensure that their C2 is not blocked by any firewalls. Data_source:
-Powershell Script Block Logging 4104
search:`powershell` EventCode=4104 ScriptBlockText IN ("*resolve-dnsname *", "*nslookup *", "*dig *") ScriptBlockText IN ("*-Type TXT*", "*type=txt*", "* TXT*") ScriptBlockText IN ("*. (*", "*IEX*")
| fillnull | stats count min(_time) as firstTime max(_time) as lastTime
by dest signature signature_id user_id vendor_product EventID Guid Opcode Name Path ProcessID ScriptBlockId ScriptBlockText
how_to_implement:To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup instructions are available at https://docs.splunk.com/Documentation/ES/latest/Admin/Configurepowershelllogging. known_false_positives:While false positives should be unlikely given the uncommon combination of PowerShell execution and DNS TXT query responses.
Due to the nature of Script Block Logging, it is possible that legitimate strings or unrelated commands might all match at once.
Apply appropriate exclusions for those edge cases. References: drilldown_searches: name:'View the detection results for - "$user_id$" and "$dest$"' search:'%original_detection_search% | search user_id = "$user_id$" dest = "$dest$"' earliest_offset:'$info_min_time$' latest_offset:'$info_max_time$' name:'View risk events for the last 7 days for - "$user_id$" and "$dest$"' search:'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user_id$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset:'7d' latest_offset:'0' analytic_story:['Malicious PowerShell', 'Command And Control', 'Suspicious DNS Traffic']
