PowerShell DNSExfiltrator Usage

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•15

This rule detects the execution of the Invoke-DNSExfiltrator PowerShell cmdlet, which is used for exfiltrating data over a DNS request covert channel. The detection specifically looks for the presence of the cmdlet name along with common parameters such as '-i', '-d', '-p', '-doh', and '-t', indicating an attempt to use the DNSExfiltrator tool.