Suspicious Nslookup Execution by Shell

Shadows VMB@Vemorian_Mort

•updated Aug 2, 2026•5•0•12

Detects the execution of nslookup.exe invoked by common shell programs (cmd.exe, powershell.exe, etc.) with command-line arguments indicative of network scanning or discovery activities, such as targeting specific IP addresses or requesting specific DNS record types.