Nslookup PowerShell Download Cradle
This rule detects the use of PowerShell in conjunction with nslookup to create a download cradle. This technique leverages nslookup to extract payloads from DNS TXT records, which are then processed by PowerShell. This is a known method for adversaries to download malicious content while potentially evading traditional network defenses by using DNS for data transfer.
Sigma
