DNS TXT Answer with Possible Command Execution Strings

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•44

Detects DNS TXT records containing strings commonly used for command execution, such as 'IEX' (Invoke-Expression), 'Invoke-Expression', and 'cmd.exe'. This technique can be used by adversaries for command and control (C2) or data exfiltration by embedding commands within DNS responses.