PowerShell Script with File Reading and DNS Resolution Capabilities

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•13

Detects PowerShell scripts that read file content, iterate through it, and perform DNS host lookups, potentially for data exfiltration or reconnaissance. This combination of actions is suspicious as it suggests an attempt to process local data and resolve external network information.