OAST DNS Tunneling via PowerShell

Ethan Andrews@eandrews

•updated Feb 25, 2026•9•0•106

This rule detects PowerShell commands used to encode data (like hostnames) into hexadecimal strings and exfiltrate it via DNS queries to known Out-of-Band Application Security Testing (OAST) domains. This technique is used by attackers to bypass egress filtering and confirm system compromise, as seen in the exploitation of CVE-2026-1731.