rules/windows/powershell/powershell_script/powershell_dnscat_execution.yml

title: Dnscat Execution
id: a6d67db4-6220-436d-8afc-f3842fe05d43
description: Dnscat exfiltration tool execution
status: experimental
author: Daniil Yugoslavskiy, oscd.community
date: 2019/10/24
modified: 2021/10/16
tags:
    - attack.exfiltration
    - attack.t1048
    - attack.execution
    - attack.t1059.001
    - attack.t1086  # an old one
logsource:
    product: windows
    category: ps_script
    definition: Script block logging must be enabled
detection:
    selection:
        ScriptBlockText|contains: "Start-Dnscat2"
    condition: selection
falsepositives:
    - Legitimate usage of PowerShell Dnscat2 — DNS Exfiltration tool (unlikely)
level: critical
Rule fixes 2020-02-20 23:00:16 +01:00			`title: Dnscat Execution`
UUIDs + moved unsupported logic 2019-12-19 23:56:36 +01:00			`id: a6d67db4-6220-436d-8afc-f3842fe05d43`
add tieto dns exfiltration rules 2019-10-25 04:30:55 +02:00			`description: Dnscat exfiltration tool execution`
			`status: experimental`
			`author: Daniil Yugoslavskiy, oscd.community`
			`date: 2019/10/24`
$frack113$ change to category: ps_script 2021-10-16 08:18:49 +02:00			`modified: 2021/10/16`
add tieto dns exfiltration rules 2019-10-25 04:30:55 +02:00			`tags:`
			`- attack.exfiltration`
			`- attack.t1048`
windows/powershell folder reviewed. Old ID’s marked with comment “an old one”. These ID’s have to be removed in future. 2020-08-24 00:01:50 +00:00			`- attack.execution`
			`- attack.t1059.001`
added missing ATT&CK v6.3 IDs with comments and removed unnecessary "modified" attributes 2020-08-25 23:51:22 +00:00			`- attack.t1086 # an old one`
add tieto dns exfiltration rules 2019-10-25 04:30:55 +02:00			`logsource:`
			`product: windows`
$frack113$ change to category: ps_script 2021-10-16 08:18:49 +02:00			`category: ps_script`
$frack113$ Cleanup PS rules 2021-08-21 09:58:58 +02:00			`definition: Script block logging must be enabled`
add tieto dns exfiltration rules 2019-10-25 04:30:55 +02:00			`detection:`
			`selection:`
add tieto dns exfil rules 2019-11-10 20:27:21 +03:00			`ScriptBlockText\|contains: "Start-Dnscat2"`
add tieto dns exfiltration rules 2019-10-25 04:30:55 +02:00			`condition: selection`
			`falsepositives:`
			`- Legitimate usage of PowerShell Dnscat2 — DNS Exfiltration tool (unlikely)`
OSCD QA wave 3 2020-01-19 22:34:16 +01:00			`level: critical`