Script host resolving a web service used for two-way C2

Siemphony@siemphonymediumT1102.002unverified

Matches a Sysmon DNS query where a scripting engine or signed-binary proxy — never a browser or a mail client — resolves a web service whose API supports both fetching an instruction and posting a result, which is AN0100's "suspicious process contacting common web service domains" leg. dns_query is chosen over the network-connection source the same analytic offers because every one of these services is fronted by shared CDN address space, so the destination IP identifies nothing, and because Sysmon EventID 22 attributes the query to the process that called the resolver while EventID 3 would only name whichever process owns the socket. The domain list is MITRE's DomainPattern knob populated here with bidirectional APIs only: read-only dead-drop endpoints such as pastebin and raw.githubusercontent are left out because a channel with no return path is a different sub-technique, and graph.microsoft.com is left out because the Graph PowerShell module makes it ordinary traffic for the very processes selected here. Two limits worth stating — the rule sees a name and nothing else, so it cannot tell a C2 poll from a legitimate API call, and it goes blind entirely against direct-to-IP callbacks, DNS-over-HTTPS, or a name already in the host resolver cache; Sysmon EventID 22 also needs DNS query logging switched on in the running configuration, which the common community configs filter hard. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0035, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 3 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Splunk · SPL

Run this as a search.

index=* ((Image="*\\powershell.exe" OR Image="*\\pwsh.exe" OR Image="*\\wscript.exe" OR Image="*\\cscript.exe" OR Image="*\\mshta.exe" OR Image="*\\rundll32.exe" OR Image="*\\regsvr32.exe" OR Image="*\\certutil.exe" OR Image="*\\curl.exe" OR Image="*\\python.exe") AND (QueryName="*api.telegram.org" OR QueryName="*discord.com" OR QueryName="*discordapp.com" OR QueryName="*api.github.com" OR QueryName="*gist.github.com" OR QueryName="*slack.com" OR QueryName="*api.trello.com" OR QueryName="*api.dropboxapi.com" OR QueryName="*content.dropboxapi.com" OR QueryName="*api.notion.com" OR QueryName="*api.imgur.com" OR QueryName="*firebaseio.com" OR QueryName="*api.twitter.com"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((TO_LOWER(process.executable) LIKE "*\\\\powershell.exe" OR TO_LOWER(process.executable) LIKE "*\\\\pwsh.exe" OR TO_LOWER(process.executable) LIKE "*\\\\wscript.exe" OR TO_LOWER(process.executable) LIKE "*\\\\cscript.exe" OR TO_LOWER(process.executable) LIKE "*\\\\mshta.exe" OR TO_LOWER(process.executable) LIKE "*\\\\rundll32.exe" OR TO_LOWER(process.executable) LIKE "*\\\\regsvr32.exe" OR TO_LOWER(process.executable) LIKE "*\\\\certutil.exe" OR TO_LOWER(process.executable) LIKE "*\\\\curl.exe" OR TO_LOWER(process.executable) LIKE "*\\\\python.exe") AND (TO_LOWER(dns.question.name) LIKE "*api.telegram.org" OR TO_LOWER(dns.question.name) LIKE "*discord.com" OR TO_LOWER(dns.question.name) LIKE "*discordapp.com" OR TO_LOWER(dns.question.name) LIKE "*api.github.com" OR TO_LOWER(dns.question.name) LIKE "*gist.github.com" OR TO_LOWER(dns.question.name) LIKE "*slack.com" OR TO_LOWER(dns.question.name) LIKE "*api.trello.com" OR TO_LOWER(dns.question.name) LIKE "*api.dropboxapi.com" OR TO_LOWER(dns.question.name) LIKE "*content.dropboxapi.com" OR TO_LOWER(dns.question.name) LIKE "*api.notion.com" OR TO_LOWER(dns.question.name) LIKE "*api.imgur.com" OR TO_LOWER(dns.question.name) LIKE "*firebaseio.com" OR TO_LOWER(dns.question.name) LIKE "*api.twitter.com"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,dns_query,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)(\\powershell\.exe$|\\pwsh\.exe$|\\wscript\.exe$|\\cscript\.exe$|\\mshta\.exe$|\\rundll32\.exe$|\\regsvr32\.exe$|\\certutil\.exe$|\\curl\.exe$|\\python\.exe$)</field>    <field name="QueryName" type="pcre2">(?i)(api\.telegram\.org$|discord\.com$|discordapp\.com$|api\.github\.com$|gist\.github\.com$|slack\.com$|api\.trello\.com$|api\.dropboxapi\.com$|content\.dropboxapi\.com$|api\.notion\.com$|api\.imgur\.com$|firebaseio\.com$|api\.twitter\.com$)</field>    <description>Script host resolving a web service used for two-way C2</description>    <mitre>      <id>T1102.002</id>    </mitre>  </rule></group>

Sentinel · KQL

Run this as a search.

Sentinel cannot express this construct. No Sentinel table is modelled for this logsource ({"category":"dns_query","product":"windows"}), so there is nothing honest to query. Pick a logsource this translator maps, or write the KQL by hand. The Sigma source is on the first tab, unchanged.

At a glance

Logsource: dns_query / windows
Level: medium
Category: reverse_shell
Sigma status: experimental
Backends: 3 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 8f7d2596-cddf-4d66-855c-b4e87be57890

ATT&CKT1102.002

T1102.002Bidirectional Communication

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonreverse shell

reverse shellAI draft — unreviewed

01 · What this rule detects

AN0100 correlates a suspicious process making HTTPS connections to common web-service domains with abnormal upload or posting behaviour that follows. This rule takes the DNS-resolution leg alone: a Sysmon dns_query event where selection_process (Image|endswith one of ten hosts — powershell.exe, pwsh.exe, wscript.exe, cscript.exe, mshta.exe, rundll32.exe, regsvr32.exe, certutil.exe, curl.exe, python.exe) is ANDed with selection_webservice (QueryName|endswith one of thirteen domains — api.telegram.org, discord.com, api.github.com, slack.com, api.dropboxapi.com, firebaseio.com, and others). A hit says a scripting engine or LOLBin resolved a domain whose API supports both fetching an instruction and posting a result — never that it fetched or posted anything.

02 · Telemetry you need

Sysmon EventID 22, category: dns_query / product: windows, copied verbatim from AN0100's DNS-query log source. dns_query is chosen over the network_connection source the same analytic offers because every listed service sits behind shared CDN address space, so a destination IP identifies nothing, and EventID 22 attributes the query to the calling process while EventID 3 would only name whichever process owns the socket. DNS query logging must be switched on in the running Sysmon configuration — it is filtered hard in common community configs. Sentinel has no table modelled for this logsource and refuses.

03 · How the logic works

The domain list is MITRE's DomainPattern knob, populated here entirely by the rule author with bidirectional APIs only: read-only dead-drop endpoints such as pastebin or raw.githubusercontent.com are left out on purpose as a different sub-technique, and graph.microsoft.com is left out because the Graph PowerShell module makes it ordinary traffic for the very processes selected here. The process list mixes interactive script hosts with LOLBin downloaders (certutil.exe, curl.exe) that have no scripting runtime of their own but can still resolve and call these APIs directly.

04 · Common false positives

The reviewer's central finding is a collision with the sibling T1567.001 rule in this corpus: both select the same dns_query source, nine of the same ten process names, and T1567.001's QueryName|endswith: 'github.com' subsumes both api.github.com and gist.github.com here. One powershell.exe lookup of api.github.com raises this rule at medium as C2 and the sibling at low as exfiltration — a contradiction neither description acknowledges.
The level itself is separately unsupported: false-positive entry 1 (developer and administrator PowerShell against api.github.com) is called the single largest source of hits, and entry 4 says the same of curl.exe in CI. The contract sets level from the top entry, and an equivalent case elsewhere in this batch was answered with low; the reviewer flags medium here as uncalibrated. A gap cuts the other way: excluding graph.microsoft.com entirely removes coverage of Microsoft Graph, among the most heavily used bidirectional C2 channels in recent reporting (GRAPHITE, SIESTAGRAPH), and the noise-based justification only actually applies to powershell.exe — mshta.exe, rundll32.exe, regsvr32.exe and certutil.exe have no benign reason to resolve Graph. The reviewer's missed false positive: scheduled latest-release checks against api.github.com (PSResourceGet, Install-Script, Chocolatey, vendor update scripts) land fleet-wide, not only on the engineering hosts entry 1 names. Domain terms also carry no leading dot, so a lookalike registration like evildiscord.com also satisfies endswith: 'discord.com'.

05 · Detection maturity

tier_1: . UNVERIFIED, derived from a MITRE scaffold with no query logic, never run against a log line.
tier_2: run read-only, rank hits by `QueryName` and then by `Image` or account, expect `api.github.com` via `powershell.exe`/`curl.exe` to dominate, and use that to populate `ProcessNameExclusionList` and settle the level split with T1567.001.
tier_3: ** correlate this resolution with the network_connection/upload-volume leg AN0100 actually specifies, under MITRE's TimeWindow and PayloadSizeThreshold, so an alert requires evidence of two-way traffic rather than a name that merely resolved.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Reconcile with T1567.001: name the sibling in each description, and
Recover Graph coverage without PowerShell's noise: add a second selection
Anchor domain matches with a leading dot if lookalike-domain matches are
MITRE's TimeWindow and PayloadSizeThreshold knobs both require

Declared by the author

Developer and administrator PowerShell reaching api.github.com — module installs, release-asset downloads, gist reads and writes, and anything wrapping the GitHub REST API. On engineering estates this is the single largest source of hits and it is why the level is not higher; the practical suppression is the account and the host role, not the domain, since removing GitHub takes out one of the most-used bidirectional channels there is.
Chat and ticketing notifications sent from scheduled scripts. A backup job posting its result to a Slack or Discord incoming webhook, or a monitoring script messaging a Telegram bot, produces a script host resolving exactly these names on a fixed schedule.
Python-based line-of-business tooling and vendor agents that bundle their own interpreter and synchronise with Dropbox, Trello or Notion through the same public APIs, appearing as python.exe against a small set of servers.
curl.exe is shipped in Windows and is the default way a build or provisioning script talks to any REST API, so a CI step publishing an artefact to a GitHub release or a Dropbox folder matches without anything unusual happening.

Noise check0 of 1 fired

The baseline holds exactly one ordinary behaviour for this log type, and the rule does not fire on it. One event is close to no evidence: this says the rule is not caught by that one behaviour, and nothing more.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1102.002, evaluated against their dns_query events.

Share this rule

/u/siemphony/8f7d2596-cddf-4d66-855c-b4e87be57890

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Script host resolving a web service used for two-way C2

The detection

detection.yml

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Sentinel · KQL

Community

Verdicts from engineers who deployed it