DNS TXT Record Payload Retrieval by Unexpected Process (T1071.004 Axiom Pattern)
Detects suspicious DNS TXT record queries originating from common script interpreters (e.g., PowerShell, Python, Node.js) that are not recognized legitimate resolvers. The rule further correlates these DNS queries with subsequent process execution or network connection activity within a 60-second window, which is indicative of potential command and control (C2) communication or stager activity.
Microsoft Sentinel (KQL)
