Nslookup and Findstr Combination for Remote System Discovery
This rule detects the execution of `nslookup` and `findstr` together in a command line, specifically looking for non-private IP addresses. This combination can indicate an adversary attempting to discover remote systems or exfiltrate data by encoding it within DNS queries, often seen in DNS tunneling or data staging activities.
Microsoft Sentinel (KQL)
