Nslookup PowerShell Download Cradle

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•14

Detects a suspicious PowerShell download cradle that leverages nslookup to extract payloads from DNS TXT records. This technique is often used for defense evasion by adversaries to retrieve malicious code or data over DNS.