DNS Staging Detection: ClickFix-Inspired nslookup Execution

# --- Query Metadata ---
# Human-readable name for the query. Will be displayed as the title.
name: "DNS Staging Detection: ClickFix-Inspired nslookup Execution"

# MITRE ATT&CK technique IDs
mitre_ids:
  - T1071.004
  - T1059.001
  - T1204.002

# Description of what the query does and its purpose.
description: |
  Detects nslookup activity used for DNS-based staging, specifically targeting the pattern of querying external nameservers to retrieve and execute malicious payloads, as seen in recent ClickFix attacks. This hunt is highly valuable as it identifies a shift away from heavily-monitored tools like mshta and PowerShell toward abusing trusted network utilities to bypass standard firewalls and blend with legitimate DNS traffic.

# The author or team that created the query.
author: cap10

# The required log sources to run this query successfully in Next-Gen SIEM.
log_sources:
  - Endpoint

# The CrowdStrike modules required to run this query.
cs_required_modules:
  - Insight

# Tags for filtering and categorization.
tags:
  - Hunting
  - Detection

# --- Query Content ---
# The actual CrowdStrike Query Language (CQL) code.
# Using the YAML block scalar `|` allows for multi-line strings.
cql: |
  // Start with process execution events for performance
  #event_simpleName = ProcessRollup2
  // Filter for nslookup.exe
  | ImageFileName = /\\nslookup\.exe$/i
  // Look for nslookup querying a non-default server or using specific record types (like TXT)
  | CommandLine = /nslookup.*(-q|querytype)=(txt|all)/i or CommandLine = /nslookup.* \d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}/
  // Exclude common administrative noise if necessary
  | ParentBaseFileName != /services\.exe|monitoring_agent\.exe/i
  // Summarize the activity
  | groupBy([ComputerName, UserName, CommandLine], function=count())
  | table([ComputerName, UserName, CommandLine, _count])

# Explanation of the query.
# Using the YAML block scalar `|` allows for multi-line strings.
# Uses markdown for formatting on the webpage.
explanation: |
  Targeting trusted binaries: Monitors nslookup.exe, which attackers now prefer because it is less likely to be blocked by security software than mshta or PowerShell.
  
  External DNS Queries: Specifically looks for nslookup commands that provide a direct IP address for an external nameserver, bypassing the system's default, monitored DNS resolver.
  
  Staging Pattern: Detects the use of findstr on the nslookup output, a known ClickFix technique to parse the "Name:" field from a DNS response and treat it as a secondary command for execution.
  
  Execution Chain: Monitors for the piping of this output directly into execution engines like PowerShell or IEX.
  
  Evasion Detection: DNS traffic is frequently allowed through corporate firewalls, making this a "lightweight staging channel" that effectively hides data exfiltration and payload delivery in plain sight.
  
  To test your query, run nslookup -q=txt google.com 1.1.1.1 in a command prompt. This triggers your detection by requesting a TXT record while bypassing local DNS to use an external IP. Wait a few minutes for the telemetry to ingest, then run your search to confirm the activity appears in your results.