Script host resolving a public content host used as a dead drop

Siemphony@siemphonylowT1102.001unverified

Matches AN0158 on Sysmon EventID 22: a scripting engine, transfer utility or signed-binary proxy — never a browser and never a mail client — resolving one of the public paste, raw-file and profile-page services an implant reads to learn where its real C2 lives. The analytic offers a network-connection leg as well; `dns_query` is chosen because every one of these services sits behind shared CDN address space, so the destination address in a Sysmon EventID 3 record identifies nothing, and because EventID 22 attributes the lookup to the process that called the resolver while EventID 3 names whichever process owns the socket. For the same reason bitsadmin.exe is absent from the image list: BITS performs the transfer inside svchost.exe and resolves nothing under its own name. The domain list is MITRE's `TargetDomain` knob populated here, and it is deliberately the complement of the corpus's T1102.002 rule, which excluded exactly these read-only endpoints on the grounds that a channel with no return path is a different sub-technique — the two lists share no entry. Two siblings do overlap, both on the identical logsource and fields. Three names (pastebin.com, hastebin.com, paste.ee) appear in this corpus's T1567 rule, and the two GitHub raw hosts are subsumed by the broader `githubusercontent.com` entry in its T1567.001 rule, so a lookup of any of those five raises two rules at once; the difference is only which hypothesis is being tested, exfiltration there and C2 resolution here. The coverage genuinely new to this rule is therefore the paste and profile-page hosts neither sibling carries — pastebin.pl, rentry.co, controlc.com, justpaste.it, telegra.ph, t.me and steamcommunity.com — and those, not the GitHub hosts that dominate the false positives below, are where its value sits. What a name resolution cannot tell you is the whole of the technique's point: the encoded address of the second-stage server lives in the response body, which no log source in this brief carries, so a match says a script fetched something from a content host and never that it read a resolver. MITRE's `TimeWindow` knob, which would tie the fetch to the follow-on connection, is a cross-event correlation lib/sigma has no timeframe or join to express. Coverage is also blind to a name already in the host resolver cache, to DNS-over-HTTPS, to a hard-coded IP, and to any service outside the list. Prerequisite: Sysmon EventID 22 requires DNS query logging to be switched on in the running configuration, which several widely used community configs filter heavily or omit. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0058, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 3 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Splunk · SPL

Run this as a search.

index=* ((Image="*\\powershell.exe" OR Image="*\\pwsh.exe" OR Image="*\\wscript.exe" OR Image="*\\cscript.exe" OR Image="*\\mshta.exe" OR Image="*\\rundll32.exe" OR Image="*\\regsvr32.exe" OR Image="*\\certutil.exe" OR Image="*\\curl.exe" OR Image="*\\python.exe" OR Image="*\\pythonw.exe") AND (QueryName="*raw.githubusercontent.com" OR QueryName="*gist.githubusercontent.com" OR QueryName="*pastebin.com" OR QueryName="*pastebin.pl" OR QueryName="*paste.ee" OR QueryName="*hastebin.com" OR QueryName="*rentry.co" OR QueryName="*controlc.com" OR QueryName="*justpaste.it" OR QueryName="*telegra.ph" OR QueryName="*t.me" OR QueryName="*steamcommunity.com"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((TO_LOWER(process.executable) LIKE "*\\\\powershell.exe" OR TO_LOWER(process.executable) LIKE "*\\\\pwsh.exe" OR TO_LOWER(process.executable) LIKE "*\\\\wscript.exe" OR TO_LOWER(process.executable) LIKE "*\\\\cscript.exe" OR TO_LOWER(process.executable) LIKE "*\\\\mshta.exe" OR TO_LOWER(process.executable) LIKE "*\\\\rundll32.exe" OR TO_LOWER(process.executable) LIKE "*\\\\regsvr32.exe" OR TO_LOWER(process.executable) LIKE "*\\\\certutil.exe" OR TO_LOWER(process.executable) LIKE "*\\\\curl.exe" OR TO_LOWER(process.executable) LIKE "*\\\\python.exe" OR TO_LOWER(process.executable) LIKE "*\\\\pythonw.exe") AND (TO_LOWER(dns.question.name) LIKE "*raw.githubusercontent.com" OR TO_LOWER(dns.question.name) LIKE "*gist.githubusercontent.com" OR TO_LOWER(dns.question.name) LIKE "*pastebin.com" OR TO_LOWER(dns.question.name) LIKE "*pastebin.pl" OR TO_LOWER(dns.question.name) LIKE "*paste.ee" OR TO_LOWER(dns.question.name) LIKE "*hastebin.com" OR TO_LOWER(dns.question.name) LIKE "*rentry.co" OR TO_LOWER(dns.question.name) LIKE "*controlc.com" OR TO_LOWER(dns.question.name) LIKE "*justpaste.it" OR TO_LOWER(dns.question.name) LIKE "*telegra.ph" OR TO_LOWER(dns.question.name) LIKE "*t.me" OR TO_LOWER(dns.question.name) LIKE "*steamcommunity.com"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,dns_query,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)(\\powershell\.exe$|\\pwsh\.exe$|\\wscript\.exe$|\\cscript\.exe$|\\mshta\.exe$|\\rundll32\.exe$|\\regsvr32\.exe$|\\certutil\.exe$|\\curl\.exe$|\\python\.exe$|\\pythonw\.exe$)</field>    <field name="QueryName" type="pcre2">(?i)(raw\.githubusercontent\.com$|gist\.githubusercontent\.com$|pastebin\.com$|pastebin\.pl$|paste\.ee$|hastebin\.com$|rentry\.co$|controlc\.com$|justpaste\.it$|telegra\.ph$|t\.me$|steamcommunity\.com$)</field>    <description>Script host resolving a public content host used as a dead drop</description>    <mitre>      <id>T1102.001</id>    </mitre>  </rule></group>

Sentinel · KQL

Run this as a search.

Sentinel cannot express this construct. No Sentinel table is modelled for this logsource ({"category":"dns_query","product":"windows"}), so there is nothing honest to query. Pick a logsource this translator maps, or write the KQL by hand. The Sigma source is on the first tab, unchanged.

At a glance

Logsource: dns_query / windows
Level: low
Category: reverse_shell
Sigma status: experimental
Backends: 3 of 4 rendered
Updated: 30 Aug 2026
Rule ID: a6a99a21-4b3a-4013-b12d-7bd8095ba9fd

ATT&CKT1102.001

T1102.001Dead Drop Resolver

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonreverse shell

reverse shellAI draft — unreviewed

01 · What this rule detects

The rule is "Script host resolving a public content host used as a dead drop", written against MITRE analytic AN0158. A dead drop resolver is a two-hop channel: an implant fetches an innocuous public page, decodes the real C2 address out of the body, then connects somewhere else entirely. This rule sees only the first hop, and only the name lookup that precedes it — a script host asking DNS for one of twelve paste, raw-file or profile-page services.

02 · Telemetry you need

One feed: Sysmon dns_query on Windows, EventID 22. It is not collected unless DNS query logging is switched on in the running Sysmon configuration, and several widely used community configs filter it heavily or omit it — confirm with sysmon -c before reading a quiet result as an absence of activity. The analytic also offers a network-connection leg, rejected here twice over: these services sit behind shared CDN address space, so a destination address on EventID 3 identifies nothing, and EventID 3 names the process that owns the socket rather than the one that called the resolver. That second point is why bitsadmin.exe is deliberately absent from the image list — BITS performs its transfers inside svchost.exe.

03 · How the logic works

Two selections, ANDed. selection_process is an Image|endswith allowlist of eleven binaries: powershell, pwsh, wscript, cscript, mshta, rundll32, regsvr32, certutil, curl, python, pythonw. selection_deaddrop is a QueryName|endswith list of twelve domains — the two GitHub raw hosts, pastebin.com and pastebin.pl, paste.ee, hastebin.com, rentry.co, controlc.com, justpaste.it, telegra.ph, t.me and steamcommunity.com. Neither half survives alone: the domains are ordinary browsing traffic, the processes resolve names all day. The pairing is the entire detection. The domain list is MITRE's TargetDomain knob populated with entries the pipeline chose — MITRE named the knob, not the values. The rule also declares its own overlap: three names appear in this corpus's T1567 rule, and both GitHub hosts are subsumed by T1567.001's broader githubusercontent.com, so the coverage genuinely new here is the seven remaining paste and profile-page hosts.

04 · Common false positives

The loudest source by a wide margin is developer bootstrap: the documented install command for Chocolatey, scoop, nvm-windows, oh-my-posh and a long tail of vendor tools is a PowerShell or curl fetch from raw.githubusercontent.com piped into the interpreter. CI runners do the same on every job, producing a steady machine-rate stream. Python tooling on analyst and data workstations reads wordlists, signature sets and config from the same host. Staff paste logs into pastebin.com or rentry.co through helper scripts. Those four are why the rule ships at level: low — a high on this logic would contradict its own first false positive.

05 · Detection maturity

tier_1: Lowest tier. This rule was authored from MITRE prose and has never been executed against a log line, so it has no measured hit rate, no tuning history and no confirmed field mapping. Run it in a hunt window against your own DNS telemetry before it earns anything above that.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Prune the domain list to services your estate has no business reaching, and allowlist the CI runners and build agents by host rather than by suppressing the domain everywhere. Review flagged three gaps worth closing locally: version-suffixed interpreters (python3.exe, python3.12.exe) slip past the endswith gate; no QueryName entry carries a leading dot, so t.me also matches any host ending in those characters; and the process allowlist itself is the largest blind spot, since the historical Steam, Telegraph and paste-site resolvers were compiled implants, not script hosts. MITRE's TimeWindow knob, which would tie the lookup to the follow-on connection, has no expression in lib/sigma — there is no timeframe or join.

Declared by the author

PowerShell and curl.exe fetching bootstrap and install scripts from raw.githubusercontent.com. The documented installation command for Chocolatey, scoop, nvm-windows, oh-my-posh and a very large number of vendor and internal tools is a download from that host piped straight into the interpreter, so on any estate with developers or build agents this is the highest-volume match by a wide margin, and it is what sets the level.
Build and packaging pipelines on CI runners, where a job fetches a pinned script, manifest or checksum file from raw.githubusercontent.com or gist.githubusercontent.com on every single run, producing a steady high-rate stream from a small number of hosts that looks nothing like a human pattern.
Python tooling on analyst, engineering and data workstations that reads its configuration, wordlists, signature sets or reference datasets from raw.githubusercontent.com and gist.githubusercontent.com, which is how a great deal of open-source tooling ships data files it does not want to vendor.
Staff sharing text through a paste service. Support and engineering teams routinely put logs and configuration into pastebin.com or rentry.co, and any helper script or PowerShell one-liner that posts or retrieves one resolves the same names from a process on this list.

Noise check0 of 1 fired

The baseline holds exactly one ordinary behaviour for this log type, and the rule does not fire on it. One event is close to no evidence: this says the rule is not caught by that one behaviour, and nothing more.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1102.001, evaluated against their dns_query events.

Share this rule

/u/siemphony/a6a99a21-4b3a-4013-b12d-7bd8095ba9fd

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Script host resolving a public content host used as a dead drop

The detection

detection.yml

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Sentinel · KQL

Community

Verdicts from engineers who deployed it