cscli scenarios install sigmahq/proc_creation_win_dns_exfiltration_tools_execution1type: trigger2name: sigmahq/proc_creation_win_dns_exfiltration_tools_execution3description: |4 Well-known DNS Exfiltration tools execution5filter: |6 (evt.Meta.service == 'sysmon' && evt.Parsed.EventID == '1') && (evt.Parsed.Image endsWith '\\iodine.exe' || evt.Parsed.Image contains '\\dnscat2')7blackhole: 2m8#status: test9labels:10 service: windows11 confidence: 112 spoofable: 013 classification:14 - attack.t1048.00115 - attack.t1071.00416 - attack.t1132.0011718 label: "DNS Exfiltration and Tunneling Tools Execution"19 behavior : "windows:audit"20 remediation: false2122scope:23 type: ParentProcessId24 expression: evt.Parsed.ParentProcessId2526