SigmaHQ/rules/windows/powershell/powershell_dnscat_execution.yml

title: Dnscat Execution
id: a6d67db4-6220-436d-8afc-f3842fe05d43
description: Dnscat exfiltration tool execution
status: experimental
author: Daniil Yugoslavskiy, oscd.community
date: 2019/10/24
tags:
    - attack.exfiltration
    - attack.t1048
logsource:
    product: windows
    service: powershell
detection:
    selection:
        EventID: 4104
        ScriptBlockText|contains: "Start-Dnscat2"
    condition: selection
falsepositives:
    - Legitimate usage of PowerShell Dnscat2 — DNS Exfiltration tool (unlikely)
level: critical
Rule fixes Made tests pass the new CI tests. Added further allowed lower case words in rule test. 2020-02-20 22:00:16 +00:00			`title: Dnscat Execution`
UUIDs + moved unsupported logic * Added UUIDs to all contributed rules * Moved unsupported logic directory out of rules/ because this breaks CI testing. 2019-12-19 22:56:36 +00:00			`id: a6d67db4-6220-436d-8afc-f3842fe05d43`
add tieto dns exfiltration rules 2019-10-25 02:30:55 +00:00			`description: Dnscat exfiltration tool execution`
			`status: experimental`
			`author: Daniil Yugoslavskiy, oscd.community`
			`date: 2019/10/24`
			`tags:`
			`- attack.exfiltration`
			`- attack.t1048`
			`logsource:`
			`product: windows`
			`service: powershell`
			`detection:`
			`selection:`
			`EventID: 4104`
add tieto dns exfil rules 2019-11-10 17:27:21 +00:00			`ScriptBlockText\|contains: "Start-Dnscat2"`
add tieto dns exfiltration rules 2019-10-25 02:30:55 +00:00			`condition: selection`
			`falsepositives:`
			`- Legitimate usage of PowerShell Dnscat2 — DNS Exfiltration tool (unlikely)`
OSCD QA wave 3 2020-01-19 21:34:16 +00:00			`level: critical`