KQL Search

# *ClickFix: Nslookup DNS Staging*

## Query Information

#### MITRE ATT&CK Technique(s)

| Technique ID | Title    | Link    |
| ---  | --- | --- |
| T1204.001 | User Execution: Malicious Link| https://attack.mitre.org/techniques/T1204/001/ |
| T1204.004 | User Execution: Malicious Copy and Paste | https://attack.mitre.org/techniques/T1204/004/ |

#### Description
Detects instances where 'nslookup.exe' is initiated by 'explorer.exe'. This activity can be indicative of an adversary performing DNS queries for reconnaissance or command and control (C2) staging, especially when not part of a legitimate administrative script or user action. The rule excludes a common false positive related to conhost.exe.

#### Author <Optional>
- **Name: Benjamin Zulliger**
- **Github: https://github.com/benscha/KQLAdvancedHunting**
- **LinkedIn: https://www.linkedin.com/in/benjamin-zulliger/**

#### References
- https://thehackernews.com/2026/02/microsoft-discloses-dns-based-clickfix.html


## Defender XDR
```KQL
// ClickFix: Nslookup DNS Staging
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where FileName =~ "nslookup.exe"
| where InitiatingProcessFileName =~ "explorer.exe"
// Exclusions
| where ProcessCommandLine != "\\??\\C:\\windows\\system32\\conhost.exe 0xffffffff -ForceV1"
```