New Rule: Windows DNS Client Rule

rules/windows/powershell/powershell_script/posh_ps_add_dnsclient_rule.yml

@@ -0,0 +1,23 @@
+title: Windows DNS Client Commands
+id: 4368354e-1797-463c-bc39-a309effbe8d7
+status: experimental
+description: Detects powershell scripts that adds a Name Resolution Policy Table (NRPT) rule for the specified namespace. This will bypass the default DNS server and uses a specified server for answering the query.
+references:
+    - https://twitter.com/NathanMcNulty/status/1569497348841287681
+    - https://docs.microsoft.com/en-us/powershell/module/dnsclient/add-dnsclientnrptrule?view=windowsserver2022-ps
+author: Borna Talebi
+date: 2021/09/14
+logsource:
+    product: windows
+    category: ps_script
+    definition: Script Block Logging must be enabled
+detection:
+    selection:
+        ScriptBlockText|contains: Add-DnsClientNrptRule
+    condition: selection
+tags:
+    - attack.impact
+    - attack.t1565
+falsepositives:
+    - Unknown
+level: high