Script host resolving a web service used for two-way C2

1title: Script host resolving a web service used for two-way C22id: 8f7d2596-cddf-4d66-855c-b4e87be578903status: experimental4description: |5  Matches a Sysmon DNS query where a scripting engine or signed-binary proxy —6  never a browser or a mail client — resolves a web service whose API supports7  both fetching an instruction and posting a result, which is AN0100's "suspicious8  process contacting common web service domains" leg. dns_query is chosen over the9  network-connection source the same analytic offers because every one of these10  services is fronted by shared CDN address space, so the destination IP identifies11  nothing, and because Sysmon EventID 22 attributes the query to the process that12  called the resolver while EventID 3 would only name whichever process owns the13  socket. The domain list is MITRE's DomainPattern knob populated here with14  bidirectional APIs only: read-only dead-drop endpoints such as pastebin and15  raw.githubusercontent are left out because a channel with no return path is a16  different sub-technique, and graph.microsoft.com is left out because the Graph17  PowerShell module makes it ordinary traffic for the very processes selected here.18  Two limits worth stating — the rule sees a name and nothing else, so it cannot19  tell a C2 poll from a legitimate API call, and it goes blind entirely against20  direct-to-IP callbacks, DNS-over-HTTPS, or a name already in the host resolver21  cache; Sysmon EventID 22 also needs DNS query logging switched on in the running22  configuration, which the common community configs filter hard.23  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0035, not hand-written and not tested by its author. Any lab result is on this rule's own page.24references:25  - https://attack.mitre.org/techniques/T1102/00226  - https://attack.mitre.org/detectionstrategies/DET003527author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)28date: 2026-08-1629tags:30  - attack.command-and-control31  - attack.t1102.00232logsource:33  category: dns_query34  product: windows35detection:36  selection_process:37    Image|endswith:38      - '\powershell.exe'39      - '\pwsh.exe'40      - '\wscript.exe'41      - '\cscript.exe'42      - '\mshta.exe'43      - '\rundll32.exe'44      - '\regsvr32.exe'45      - '\certutil.exe'46      - '\curl.exe'47      - '\python.exe'48  selection_webservice:49    QueryName|endswith:50      - 'api.telegram.org'51      - 'discord.com'52      - 'discordapp.com'53      - 'api.github.com'54      - 'gist.github.com'55      - 'slack.com'56      - 'api.trello.com'57      - 'api.dropboxapi.com'58      - 'content.dropboxapi.com'59      - 'api.notion.com'60      - 'api.imgur.com'61      - 'firebaseio.com'62      - 'api.twitter.com'63  condition: selection_process and selection_webservice64falsepositives:65  - "Developer and administrator PowerShell reaching api.github.com — module installs, release-asset downloads, gist reads and writes, and anything wrapping the GitHub REST API. On engineering estates this is the single largest source of hits and it is why the level is not higher; the practical suppression is the account and the host role, not the domain, since removing GitHub takes out one of the most-used bidirectional channels there is."66  - "Chat and ticketing notifications sent from scheduled scripts. A backup job posting its result to a Slack or Discord incoming webhook, or a monitoring script messaging a Telegram bot, produces a script host resolving exactly these names on a fixed schedule."67  - "Python-based line-of-business tooling and vendor agents that bundle their own interpreter and synchronise with Dropbox, Trello or Notion through the same public APIs, appearing as python.exe against a small set of servers."68  - "curl.exe is shipped in Windows and is the default way a build or provisioning script talks to any REST API, so a CI step publishing an artefact to a GitHub release or a Dropbox folder matches without anything unusual happening."69level: medium