PowerShell DNS Query to Suspicious Domains

Tim Peck@timpeck

•updated Jan 5, 2026•6•2•166

Detects PowerShell making DNS requests for domains associated with less-reputable/uncommon TLDs. This behavior is not typical for legitimate administrative scripts and can indicate an attempt to download a payload from a malicious source.