Detection of PowerShell-Based Command and Control via DNS TXT Records

This threat involves the use of DNS TXT records as a covert channel for command-and-control (C2) communications. By embedding commands or configuration data within DNS TXT records, attackers can exfiltrate data or retrieve instructions that are often overlooked by standard firewall and proxy egress filtering, as DNS traffic is typically permitted for name resolution. The technique leverages native Windows PowerShell commands, specifically utilities like resolve-dnsname, nslookup, or dig, in conjunction with execution primitives such as Invoke-Expression (IEX) to execute the contents of the DNS response. This method provides a resilient communication channel that is difficult to disrupt without impacting legitimate network name resolution. Detection relies on monitoring PowerShell Script Block Logging (Event ID 4104) to capture the specific script blocks that perform both the DNS lookup and the subsequent execution of the retrieved data.

Impact

Successful implementation of this C2 technique allows attackers to maintain persistent, stealthy control over compromised hosts, facilitate lateral movement, or coordinate multi-stage malware execution while avoiding traditional network security boundaries. This represents a significant risk for organizations with strict egress filtering policies, as it exploits the necessary reliance on DNS infrastructure to bypass these controls.

Recommendation

Deploy detection for PowerShell execution patterns involving DNS query utilities and script execution commands. Ensure PowerShell Script Block Logging (Event ID 4104) is enabled across all endpoints to provide the visibility required to identify this activity. Use the provided Sigma rule to monitor for concurrent invocation of DNS lookup utilities and script execution functions.