---
title: >-
  DNS TXT record answer containing command-execution strings (possible DNS-based
  C2)
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > DNS TXT record answer containing
  command-execution strings (possible DNS-based C2)
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# DNS TXT record answer containing command-execution strings (possible DNS-based C2)
Classification:attackTactic:[TA0010-exfiltration](https://attack.mitre.org/tactics/TA0010)Technique:[T1041-exfiltration-over-c2-channel](https://attack.mitre.org/techniques/T1041) 
## Goal{% #goal %}

Detects a DNS `TXT` record answer whose response data contains a known command-execution string. This can indicate payload delivery through a DNS-based command-and-control channel.

## Strategy{% #strategy %}

This rule monitors DNS `TXT` record responses where `@ocsf.answers.rdata` contains a string associated with remote command execution, such as `IEX`, `Invoke-Expression`, `cmd.exe`, `/bin/sh`, or `/bin/bash`.

Because `TXT` records can contain arbitrary text, DNS-based backdoors such as those in Nishang can use them to deliver Windows or Linux commands to compromised hosts. A command can arrive in a single lookup, so this rule inspects answer content rather than query volume or hostname cardinality.

A single matching answer triggers the rule, but does not confirm malicious activity. Investigate the response content and associated endpoint activity to determine whether it is malicious.

## Triage and Response{% #triage-and-response %}

- Examine the full `TXT` record answer returned to `{{@ocsf.src_endpoint.ip}}` to determine the exact command or payload embedded in the response.
- Identify the process on `{{@ocsf.src_endpoint.ip}}` that issued the DNS query and check whether it is a script interpreter, scheduled task, or other automation capable of executing the returned string.
- Review the queried domain `{{@ocsf.query.hostname}}` for recent registration, low reputation, or association with known C2 infrastructure.
- Check whether `{{@ocsf.src_endpoint.ip}}` executed the delivered command by reviewing subsequent process-creation or script-execution activity on the host.
- Determine if the same domain or a related domain has served similar `TXT` answers to other hosts in the environment, indicating a broader campaign.
- Review outbound network connections from `{{@ocsf.src_endpoint.ip}}` following the DNS response for a follow-on command-and-control or data-exfiltration channel.