Long encoded DNS label queried by a script host or proxy binary

Siemphony@siemphonylowT1071.004unverifiedPlaybook · Command and control

AN1121 describes DNS tunnelling as anomalous lookups issued by non-browser, non-system processes, and the Sysmon DNS query event is the one Windows source that names the process which actually called the resolver, so it can bind an encoded lookup to the interpreter that made it — unlike the network connection event, where a DNS query is attributed to the service host rather than the caller. The rule requires both halves: an image from the script host, signed proxy and interpreter set that has no business resolving names in bulk, and a leftmost DNS label of forty characters or more, which is the shape a base32 or base64 payload takes inside a query. The length gate stands in for MITRE's QueryLengthThreshold knob and the image list for its ProcessImageFilter knob; both sets of values are authored here, not supplied by MITRE. The remaining knobs, TimeWindow and query rate, need counting over an interval and Sigma has no way to express that, which is why this is a shape test rather than a frequency test. Two consequences follow and neither is tunable away: a compiled tunnelling client resolves under its own image and will not match the list, and an operator who keeps labels short to stay under a threshold defeats the regex. Sysmon EventID 22 needs Sysmon 10 or later with DNS query logging enabled, and most shipped configurations filter or exclude it outright, so confirm it is being collected before reading a quiet result as a clean one. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0400, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 2 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

1title: Long encoded DNS label queried by a script host or proxy binary2id: 8ed8a425-0c85-4725-ac51-d63578d5ddfb3status: experimental4description: |5  AN1121 describes DNS tunnelling as anomalous lookups issued by non-browser,6  non-system processes, and the Sysmon DNS query event is the one Windows source7  that names the process which actually called the resolver, so it can bind an8  encoded lookup to the interpreter that made it — unlike the network connection9  event, where a DNS query is attributed to the service host rather than the10  caller. The rule requires both halves: an image from the script host, signed11  proxy and interpreter set that has no business resolving names in bulk, and a12  leftmost DNS label of forty characters or more, which is the shape a base32 or13  base64 payload takes inside a query. The length gate stands in for MITRE's14  QueryLengthThreshold knob and the image list for its ProcessImageFilter knob;15  both sets of values are authored here, not supplied by MITRE. The remaining16  knobs, TimeWindow and query rate, need counting over an interval and Sigma has17  no way to express that, which is why this is a shape test rather than a18  frequency test. Two consequences follow and neither is tunable away: a19  compiled tunnelling client resolves under its own image and will not match the20  list, and an operator who keeps labels short to stay under a threshold defeats21  the regex. Sysmon EventID 22 needs Sysmon 10 or later with DNS query logging22  enabled, and most shipped configurations filter or exclude it outright, so23  confirm it is being collected before reading a quiet result as a clean one.24  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0400, not hand-written and not tested by its author. Any lab result is on this rule's own page.25references:26  - https://attack.mitre.org/techniques/T1071/00427  - https://attack.mitre.org/detectionstrategies/DET040028author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)29date: 2026-08-1630tags:31  - attack.command-and-control32  - attack.t1071.00433logsource:34  category: dns_query35  product: windows36detection:37  selection_process:38    Image|endswith:39      - '\powershell.exe'40      - '\pwsh.exe'41      - '\rundll32.exe'42      - '\regsvr32.exe'43      - '\mshta.exe'44      - '\wscript.exe'45      - '\cscript.exe'46      - '\nslookup.exe'47      - '\certutil.exe'48      - '\python.exe'49      - '\msbuild.exe'50      - '\installutil.exe'51  selection_encoded_label:52    QueryName|re: '^[A-Za-z0-9_-]{40,}\.'53  condition: selection_process and selection_encoded_label54falsepositives:55  - "Developer and build hosts running python.exe or pwsh.exe against cloud SDKs, where per-object, per-tenant and per-request endpoints are resolved as generated hostnames whose leftmost label runs well past forty characters — one busy build agent can produce a steady stream of matches and this is the loudest entry here."56  - "Endpoint security and reputation tooling that encodes a file hash or telemetry blob into the leftmost DNS label of a vendor lookup domain, which is the same query shape as a tunnel; when such a lookup is driven from a management script under powershell.exe it matches both halves of this rule."57  - "An administrator resolving a long auto-generated cloud endpoint by hand with Resolve-DnsName inside a PowerShell session during troubleshooting, which needs no repetition to alert — a single lookup of a front-door, load-balancer or CDN hostname is enough."58  - "Scheduled PowerShell tasks that call update, licensing or certificate-transparency services addressing each request through a randomised hostname, which resolve on a fixed interval whether or not anyone is at the keyboard."59level: low

Splunk · SPL

Run this as a search.

index=* | where ((match(Image, "(?i)\\\\powershell\\.exe$") OR match(Image, "(?i)\\\\pwsh\\.exe$") OR match(Image, "(?i)\\\\rundll32\\.exe$") OR match(Image, "(?i)\\\\regsvr32\\.exe$") OR match(Image, "(?i)\\\\mshta\\.exe$") OR match(Image, "(?i)\\\\wscript\\.exe$") OR match(Image, "(?i)\\\\cscript\\.exe$") OR match(Image, "(?i)\\\\nslookup\\.exe$") OR match(Image, "(?i)\\\\certutil\\.exe$") OR match(Image, "(?i)\\\\python\\.exe$") OR match(Image, "(?i)\\\\msbuild\\.exe$") OR match(Image, "(?i)\\\\installutil\\.exe$")) AND match(QueryName, "^[A-Za-z0-9_-]{40,}\\."))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,dns_query,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)(\\powershell\.exe$|\\pwsh\.exe$|\\rundll32\.exe$|\\regsvr32\.exe$|\\mshta\.exe$|\\wscript\.exe$|\\cscript\.exe$|\\nslookup\.exe$|\\certutil\.exe$|\\python\.exe$|\\msbuild\.exe$|\\installutil\.exe$)</field>    <field name="QueryName" type="pcre2">(?i)^[A-Za-z0-9_-]{40,}\.</field>    <description>Long encoded DNS label queried by a script host or proxy binary</description>    <mitre>      <id>T1071.004</id>    </mitre>  </rule></group>

Sentinel · KQL

Run this as a search.

Sentinel cannot express this construct. No Sentinel table is modelled for this logsource ({"category":"dns_query","product":"windows"}), so there is nothing honest to query. Pick a logsource this translator maps, or write the KQL by hand. The Sigma source is on the first tab, unchanged.

Elastic · ES|QL

Run this as a search.

Elastic cannot express this construct. ES|QL RLIKE uses Lucene regexp syntax, which has no case-insensitive flag, and Sigma regexes are case-insensitive. Use |contains/|startswith/|endswith, or write the ES|QL by hand. The Sigma source is on the first tab, unchanged.

At a glance

Logsource: dns_query / windows
Level: low
Category: reverse_shell
Sigma status: experimental
Backends: 2 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 8ed8a425-0c85-4725-ac51-d63578d5ddfb

ATT&CKT1071.004

T1071.004DNS

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Evidence

Verificationnone

Never run

The lab has not evaluated this composition. A run needs a dataset of its log type — a capture of the technique it claims, or the benign baseline — and not every rule has one. Some are also held back by the evaluator’s own safety limits.

Other compositions here have been run and some carry the badge — this one has not, so nothing about it has been shown either way. Read the rule and its noise check on their own terms; silence here is the absence of evidence, not evidence of a problem.

Noise checkdid not run

The Sigma source did not build into an evaluable rule, so the check did not run. this rule uses a regular expression, which is not evaluated here — an untrusted pattern can be made to run for a very long time

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1071.004, evaluated against their dns_query events.

Using it

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Baseline before you deploy: run the regex alone for a week and read the resulting hostname list. Suppress your build fleet by host rather than by dropping python.exe from the list. Raise forty toward forty-five if your SDK traffic swamps it — note that T1001.001 already publishes the length test alone at forty-five on this same logsource, so the two rules will double-alert. Populate MITRE's ProcessImageFilter knob with what your estate actually runs.

Declared by the author

Developer and build hosts running python.exe or pwsh.exe against cloud SDKs, where per-object, per-tenant and per-request endpoints are resolved as generated hostnames whose leftmost label runs well past forty characters — one busy build agent can produce a steady stream of matches and this is the loudest entry here.
Endpoint security and reputation tooling that encodes a file hash or telemetry blob into the leftmost DNS label of a vendor lookup domain, which is the same query shape as a tunnel; when such a lookup is driven from a management script under powershell.exe it matches both halves of this rule.
An administrator resolving a long auto-generated cloud endpoint by hand with Resolve-DnsName inside a PowerShell session during troubleshooting, which needs no repetition to alert — a single lookup of a front-door, load-balancer or CDN hostname is enough.
Scheduled PowerShell tasks that call update, licensing or certificate-transparency services addressing each request through a randomised hostname, which resolve on a fixed interval whether or not anyone is at the keyboard.

Lessonreverse shell

reverse shellAI draft — unreviewed

01 · What this rule detects

One narrow shape of DNS tunnelling: a script host or signed proxy binary resolving a hostname whose leftmost label is forty characters or longer. That is what a base32 or base64 chunk looks like when it is carried inside a query name. The rule does not detect DNS command and control generally. It detects an encoded-looking lookup made by a process that has no ordinary reason to resolve names in bulk, and nothing beyond that.

02 · Telemetry you need

Sysmon EventID 22, mapped to the dns_query / windows logsource copied from AN1121. This is the only Windows source that names the process which called the resolver; on a network connection event a DNS packet is attributed to the service host, not the caller, so the caller-identity half of this rule is impossible there. EventID 22 needs Sysmon 10 or later with DNS query logging enabled, and most shipped Sysmon configurations filter or exclude it outright. Confirm it is flowing before you read an empty result as a clean estate. Two of four backends refuse this rule: Sentinel KQL has no table modelled for dns_query, and Elastic ES|QL rejects the regex because RLIKE has no case-insensitive flag. Those are translator gaps, recorded in validation.json.

03 · How the logic works

Two selections, ANDed. selection_process matches Image|endswith against a list of interpreters and proxy binaries — powershell.exe, pwsh.exe, rundll32.exe, regsvr32.exe, mshta.exe, wscript.exe, cscript.exe, nslookup.exe, certutil.exe, python.exe, msbuild.exe, installutil.exe. selection_encoded_label applies QueryName|re: '^[A-Za-z0-9_-]{40,}\.', anchored so only the leftmost label is measured. MITRE names the knobs QueryLengthThreshold and ProcessImageFilter; the forty-character value and the whole image list are the pipeline's own, not MITRE's. MITRE's remaining knobs, TimeWindow and query rate, need counting over an interval, which Sigma cannot express — hence a shape test rather than a frequency test. Two consequences follow and neither is tunable. A compiled tunnelling client resolves under its own image and never matches the list. An encoder that splits its payload across several short labels — a routine iodine or dnscat2 setting — never presents a forty-character leftmost label. Review also flagged \nslookup.exe as probably a dead branch: nslookup builds its own DNS packets rather than calling the client resolver, so it likely emits no EventID 22 at all.

04 · Common false positives

Cloud SDKs generate per-object and per-tenant hostnames with very long leftmost labels, so a build agent running python.exe or pwsh.exe is the loudest source here by a wide margin — that is why the rule ships at level: low rather than medium. Reputation and endpoint-security tooling encodes hashes into lookup labels, producing exactly the tunnel shape. A single Resolve-DnsName against a CDN or front-door hostname alerts with no repetition at all.

05 · Detection maturity

tier_1: Lowest tier. This rule has never been run against a log line, and both its threshold and its image list are guesses. It cannot advance until someone executes it on a real Sysmon 22 feed, confirms the nslookup branch is live or drops it, and measures the false positive rate against real build hosts.

Related detections6 nearby

Ranked by how alike the detection logic reads, computed offline. Proximity is not evidence — each of these carries its own verification state on its own page.

Share this rule

/u/siemphony/8ed8a425-0c85-4725-ac51-d63578d5ddfb

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Long encoded DNS label queried by a script host or proxy binary

The detection

detection.yml

Splunk · SPL

Wazuh · XML rule

Sentinel · KQL

Elastic · ES|QL

Community

Verdicts from engineers who deployed it