GitHub Repo

Detection: Windows Powershell Commands from DNS TXT

Updated Date: 2026-07-30 ID: b61353cd-5b09-4699-8b86-6517a9038043 Author: Raven Tait, Splunk Type: Anomaly Product: Splunk Enterprise Security

Description

The following analytic detects execution of powershell commands retrieved from a remote DNS TXT query response. The use of the DNS TXT record for C2 is an uncommon method for malware that is resilient due to the need for DNS in normal networking activities. This can ensure that their C2 is not blocked by any firewalls.

 1`powershell`
 2EventCode=4104
 3ScriptBlockText IN ("*resolve-dnsname *", "*nslookup *", "*dig *")
 4ScriptBlockText IN ("*-Type TXT*", "*type=txt*", "* TXT*")
 5ScriptBlockText IN ("*. (*", "*IEX*")
 6
 7
 8| fillnull
 9
10| stats count min(_time) as firstTime
11              max(_time) as lastTime
12
13by dest signature signature_id
14   user_id vendor_product EventID
15   Guid Opcode Name
16   Path ProcessID ScriptBlockId
17   ScriptBlockText
18
19
20| `security_content_ctime(firstTime)`
21
22| `security_content_ctime(lastTime)`
23
24| `windows_powershell_commands_from_dns_txt_filter`

Data Source

Name Platform Sourcetype Source
Powershell Script Block Logging 4104 Windows icon Windows 'XmlWinEventLog' 'XmlWinEventLog:Microsoft-Windows-PowerShell/Operational'

Macros Used

Name Value
security_content_ctime convert timeformat="%Y-%m-%dT%H:%M:%S" ctime($field$)
windows_powershell_commands_from_dns_txt_filter search *
windows_powershell_commands_from_dns_txt_filter is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Annotations

- MITRE ATT&CK
+ Kill Chain Phases
+ NIST
+ CIS
- Threat Actors
ID Technique Tactic
T1059.001 PowerShell Execution
T1071.004 DNS Command and Control
Installation
Command and Control
DE.AE
CIS 10

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Setting Value
Disabled true
Cron Schedule 0 * * * *
Earliest Time -70m@m
Latest Time -10m@m
Schedule Window auto
Creates Finding (Notable) No
Creates Intermediate Finding (Risk Event) Yes
Anomaly detections generate Intermediate Findings (Risk Events). They do not generate a Finding (Notable) directly.

Implementation

To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup instructions are available at https://docs.splunk.com/Documentation/ES/latest/Admin/Configurepowershelllogging.

Known False Positives

While false positives should be unlikely given the uncommon combination of PowerShell execution and DNS TXT query responses. Due to the nature of Script Block Logging, it is possible that legitimate strings or unrelated commands might all match at once. Apply appropriate exclusions for those edge cases.

Associated Analytic Story

Intermediate Findings

Message Entity Field Entity Type Risk Score
A suspicious PowerShell script with the ScriptBlockId [$ScriptBlockId$] containing DNS TXT query commands was executed on host $dest$ by user $user_id$ user_id user 20
A suspicious PowerShell script with the ScriptBlockId [$ScriptBlockId$] containing DNS TXT query commands was executed on host $dest$ dest system 20

Detection Testing

Test Type Status Dataset Source Sourcetype
Validation ✅ Passing N/A N/A N/A
Unit ✅ Passing Dataset XmlWinEventLog:Microsoft-Windows-PowerShell/Operational XmlWinEventLog
Integration ✅ Passing Dataset XmlWinEventLog:Microsoft-Windows-PowerShell/Operational XmlWinEventLog

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub |

Version: 1