SigmaHQ/rules/windows/powershell/powershell_dnscat_execution.yml

20 lines
489 B
YAML
Raw Normal View History

2019-10-25 02:30:55 +00:00
title: Dnscat execution
description: Dnscat exfiltration tool execution
status: experimental
author: Daniil Yugoslavskiy, oscd.community
date: 2019/10/24
tags:
- attack.exfiltration
- attack.t1048
logsource:
product: windows
service: powershell
detection:
selection:
EventID: 4104
ScriptBlockText: "*Start-Dnscat2*"
condition: selection
falsepositives:
- Legitimate usage of PowerShell Dnscat2 — DNS Exfiltration tool (unlikely)
level: medium