Nslookup Execution (Windows Event Log)

id: '6172.6717'
title: Nslookup Execution
description: 'nslookup (from name server lookup) is a network administration command-line
  tool for querying the Domain Name System (DNS) to obtain domain name or IP address
  mapping, or other DNS records. Adversaries can use nslookup for various attack methods.
  Living Off the Land Binary and Scripts (LOLBAS) (LOLBIN) Threat Actor Association:
  FIN7'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) (TERM(nslookup) OR "nslookup.exe") | table _time,
  host, user, signature_id, process, process_*, parent_process_* | bin span=1s | stats
  values(*) as * by _time, host '
techniques:
- defense-evasion:system binary proxy execution
- discovery:system network configuration discovery
technique_id: 
- T1218
- T1016
data_category:
- Windows event logs
references:
- https://isc.sans.edu/forums/diary/Exfiltrating+data+from+very+isolated+environments/23645/
- https://www.securityfocus.com/images/guestfeature/xinetica/How%20attackers%20exploit%20information%20for%20their%20own%20purposes.htm