Script host resolving a public content host used as a dead drop

1title: Script host resolving a public content host used as a dead drop2id: a6a99a21-4b3a-4013-b12d-7bd8095ba9fd3status: experimental4description: |5  Matches AN0158 on Sysmon EventID 22: a scripting engine, transfer utility or6  signed-binary proxy — never a browser and never a mail client — resolving one7  of the public paste, raw-file and profile-page services an implant reads to8  learn where its real C2 lives. The analytic offers a network-connection leg as9  well; `dns_query` is chosen because every one of these services sits behind10  shared CDN address space, so the destination address in a Sysmon EventID 311  record identifies nothing, and because EventID 22 attributes the lookup to the12  process that called the resolver while EventID 3 names whichever process owns13  the socket. For the same reason bitsadmin.exe is absent from the image list:14  BITS performs the transfer inside svchost.exe and resolves nothing under its15  own name. The domain list is MITRE's `TargetDomain` knob populated here, and16  it is deliberately the complement of the corpus's T1102.002 rule, which17  excluded exactly these read-only endpoints on the grounds that a channel with18  no return path is a different sub-technique — the two lists share no entry.19  Two siblings do overlap, both on the identical logsource and fields. Three20  names (pastebin.com, hastebin.com, paste.ee) appear in this corpus's T156721  rule, and the two GitHub raw hosts are subsumed by the broader22  `githubusercontent.com` entry in its T1567.001 rule, so a lookup of any of23  those five raises two rules at once; the difference is only which hypothesis24  is being tested, exfiltration there and C2 resolution here. The coverage25  genuinely new to this rule is therefore the paste and profile-page hosts26  neither sibling carries — pastebin.pl, rentry.co, controlc.com, justpaste.it,27  telegra.ph, t.me and steamcommunity.com — and those, not the GitHub hosts28  that dominate the false positives below, are where its value sits.29  What a name resolution cannot tell you is the whole of the technique's point:30  the encoded address of the second-stage server lives in the response body,31  which no log source in this brief carries, so a match says a script fetched32  something from a content host and never that it read a resolver. MITRE's33  `TimeWindow` knob, which would tie the fetch to the follow-on connection, is a34  cross-event correlation lib/sigma has no timeframe or join to express.35  Coverage is also blind to a name already in the host resolver cache, to36  DNS-over-HTTPS, to a hard-coded IP, and to any service outside the list.37  Prerequisite: Sysmon EventID 22 requires DNS query logging to be switched on38  in the running configuration, which several widely used community configs39  filter heavily or omit.40  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0058, not hand-written and not tested by its author. Any lab result is on this rule's own page.41references:42  - https://attack.mitre.org/techniques/T1102/00143  - https://attack.mitre.org/detectionstrategies/DET005844author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)45date: 2026-08-1646tags:47  - attack.command-and-control48  - attack.t1102.00149logsource:50  category: dns_query51  product: windows52detection:53  selection_process:54    Image|endswith:55      - '\powershell.exe'56      - '\pwsh.exe'57      - '\wscript.exe'58      - '\cscript.exe'59      - '\mshta.exe'60      - '\rundll32.exe'61      - '\regsvr32.exe'62      - '\certutil.exe'63      - '\curl.exe'64      - '\python.exe'65      - '\pythonw.exe'66  selection_deaddrop:67    QueryName|endswith:68      - 'raw.githubusercontent.com'69      - 'gist.githubusercontent.com'70      - 'pastebin.com'71      - 'pastebin.pl'72      - 'paste.ee'73      - 'hastebin.com'74      - 'rentry.co'75      - 'controlc.com'76      - 'justpaste.it'77      - 'telegra.ph'78      - 't.me'79      - 'steamcommunity.com'80  condition: selection_process and selection_deaddrop81falsepositives:82  - "PowerShell and curl.exe fetching bootstrap and install scripts from raw.githubusercontent.com. The documented installation command for Chocolatey, scoop, nvm-windows, oh-my-posh and a very large number of vendor and internal tools is a download from that host piped straight into the interpreter, so on any estate with developers or build agents this is the highest-volume match by a wide margin, and it is what sets the level."83  - "Build and packaging pipelines on CI runners, where a job fetches a pinned script, manifest or checksum file from raw.githubusercontent.com or gist.githubusercontent.com on every single run, producing a steady high-rate stream from a small number of hosts that looks nothing like a human pattern."84  - "Python tooling on analyst, engineering and data workstations that reads its configuration, wordlists, signature sets or reference datasets from raw.githubusercontent.com and gist.githubusercontent.com, which is how a great deal of open-source tooling ships data files it does not want to vendor."85  - "Staff sharing text through a paste service. Support and engineering teams routinely put logs and configuration into pastebin.com or rentry.co, and any helper script or PowerShell one-liner that posts or retrieves one resolves the same names from a process on this list."86level: low