rules/windows/powershell/powershell_script/posh_ps_dnscat_execution.yml

title: Dnscat Execution
id: a6d67db4-6220-436d-8afc-f3842fe05d43
status: test
description: Dnscat exfiltration tool execution
author: Daniil Yugoslavskiy, oscd.community
date: 2019/10/24
modified: 2022/12/25
tags:
    - attack.exfiltration
    - attack.t1048
    - attack.execution
    - attack.t1059.001
logsource:
    product: windows
    category: ps_script
    definition: 'Requirements: Script Block Logging must be enabled'
detection:
    selection:
        ScriptBlockText|contains: 'Start-Dnscat2'
    condition: selection
falsepositives:
    - Legitimate usage of PowerShell Dnscat2 — DNS Exfiltration tool (unlikely)
level: critical
Rule fixes 2020-02-20 23:00:16 +01:00			`title: Dnscat Execution`
UUIDs + moved unsupported logic 2019-12-19 23:56:36 +01:00			`id: a6d67db4-6220-436d-8afc-f3842fe05d43`
$frack113$ Promotion rules (#3821 ) 2022-12-27 12:29:10 +01:00			`status: test`
$frack113$ Order yaml field 2022-10-26 09:43:39 +02:00			`description: Dnscat exfiltration tool execution`
add tieto dns exfiltration rules 2019-10-25 04:30:55 +02:00			`author: Daniil Yugoslavskiy, oscd.community`
			`date: 2019/10/24`
$frack113$ Promotion rules (#3821 ) 2022-12-27 12:29:10 +01:00			`modified: 2022/12/25`
add tieto dns exfiltration rules 2019-10-25 04:30:55 +02:00			`tags:`
			`- attack.exfiltration`
			`- attack.t1048`
windows/powershell folder reviewed. Old ID’s marked with comment “an old one”. These ID’s have to be removed in future. 2020-08-24 00:01:50 +00:00			`- attack.execution`
			`- attack.t1059.001`
add tieto dns exfiltration rules 2019-10-25 04:30:55 +02:00			`logsource:`
			`product: windows`
$frack113$ change to category: ps_script 2021-10-16 08:18:49 +02:00			`category: ps_script`
feat: updates and enhancements 2023-01-04 17:49:32 +01:00			`definition: 'Requirements: Script Block Logging must be enabled'`
add tieto dns exfiltration rules 2019-10-25 04:30:55 +02:00			`detection:`
			`selection:`
$frack113$ Change double quote to quote 2022-01-06 14:02:35 +01:00			`ScriptBlockText\|contains: 'Start-Dnscat2'`
add tieto dns exfiltration rules 2019-10-25 04:30:55 +02:00			`condition: selection`
			`falsepositives:`
			`- Legitimate usage of PowerShell Dnscat2 — DNS Exfiltration tool (unlikely)`
OSCD QA wave 3 2020-01-19 22:34:16 +01:00			`level: critical`