Axiom DNS TXT Record Fetched and Piped to Bash for Fileless Execution
Detects the resolution of DNS TXT records using dig, followed by piping the decoded base64 output directly to bash for execution. This technique is characteristic of fileless payload delivery and remote command execution, specifically observed in the Axiom indirect prompt injection attack chain.
Microsoft Sentinel (KQL)
