Suspicious DNS Lookup and Execution Pattern

Swachchhanda Shrawan Poudel (Nextron Systems)

Detects suspicious command line patterns involving 'nslookup' piped to 'findstr' with a subsequent 'for' loop, which may indicate an attempt to query DNS for second-stage payloads and execute them. This technique can be used by adversaries to leverage DNS as a covert command and control channel, allowing them to retrieve and execute malicious payloads without directly connecting to an external server.

2026-03-16 00:00:00

None

2cd058f1-9733-452e-a869-c5f09630227e

attack.command-and-control attack.execution attack.t1059 attack.t1071.004

Nextron Sigma feed only (private)