Windows Powershell Commands from DNS TXT

SPLUNK detection rule by Raven Tait, Splunk · Apache-2.0

The following analytic detects execution of powershell commands retrieved from a remote DNS TXT query response. The use of the DNS TXT record for C2 is an uncommon method for malware that is resilient due to the need for DNS in normal networking activities. This can ensure that their C2 is not blocked by any firewalls.

name: Windows Powershell Commands from DNS TXT
id: b61353cd-5b09-4699-8b86-6517a9038043
version: 1
creation_date: '2026-07-30'
modification_date: '2026-07-30'
author: Raven Tait, Splunk
status: production
type: Anomaly
description: |-
    The following analytic detects execution of powershell commands retrieved from a remote DNS TXT query response.
    The use of the DNS TXT record for C2 is an uncommon method for malware that is resilient due to the need for DNS in normal networking
    activities.
    This can ensure that their C2 is not blocked by any firewalls.
data_source:
    - Powershell Script Block Logging 4104
search: |-
    `powershell`
    EventCode=4104
    ScriptBlockText IN ("*resolve-dnsname *", "*nslookup *", "*dig *")
    ScriptBlockText IN ("*-Type TXT*", "*type=txt*", "* TXT*")
    ScriptBlockText IN ("*. (*", "*IEX*")

    | fillnull
    | stats count min(_time) as firstTime
                  max(_time) as lastTime

    by dest signature signature_id
       user_id vendor_product EventID
       Guid Opcode Name
       Path ProcessID ScriptBlockId
       ScriptBlockText

    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_powershell_commands_from_dns_txt_filter`
how_to_implement: |-
    To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup instructions are available at https://docs.splunk.com/Documentation/ES/latest/Admin/Configurepowershelllogging.
known_false_positives: |-
    While false positives should be unlikely given the uncommon combination of PowerShell execution and DNS TXT query responses.
    Due to the nature of Script Block Logging, it is possible that legitimate strings or unrelated commands might all match at once.
    Apply appropriate exclusions for those edge cases.
drilldown_searches:
    - name: View the detection results for - "$user_id$" and "$dest$"
      search: '%original_detection_search% | search  user_id = "$user_id$" dest = "$dest$"'
      earliest_offset: $info_min_time$
      latest_offset: $info_max_time$
    - name: View risk events for the last 7 days for - "$user_id$" and "$dest$"
      search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user_id$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
      earliest_offset: 7d
      latest_offset: "0"
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: A suspicious PowerShell script with the ScriptBlockId [$ScriptBlockId$] containing DNS TXT query commands was executed on host $dest$
        - field: user_id
          type: user
          score: 20
          message: A suspicious PowerShell script with the ScriptBlockId [$ScriptBlockId$] containing DNS TXT query commands was executed on host $dest$ by user $user_id$
analytic_story:
    - Malicious PowerShell
    - Command And Control
    - Suspicious DNS Traffic
asset_type: Endpoint
mitre_attack_id:
    - T1071.004
    - T1059.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint
tests:
    - name: True Positive Test
      attack_data:
        - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1071.004/windows_powershell_commands_from_dns_txt/snapattack_windows.log
          source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
          sourcetype: XmlWinEventLog
      test_type: unit

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

f80f9cbd-53b2-40b4-9040-a3ae1cf41e13

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion