Detects execution of Windows PowerShell commands that are retrieved from remote DNS TXT query responses. This analytic relies on Windows PowerShell Script Block Logging (Event ID 4104) and searches for ScriptBlockText patterns that indicate DNS-based command delivery. It flags invocations of DNS lookup commands such as resolve-dnsname, nslookup, or dig, combined with TXT record queries (-Type TXT, type=txt, TXT). It also looks for suspicious command fragments like IEX that are commonly used to execute decoded payloads. The rule aggregates matches by destination, user and script block metadata, timestamps firstTime/lastTime, and applies a Windows PowerShell DNS TXT filter macro to reduce noise. It maps to MITRE techniques T1071.004 (DNS) and T1059.001 (PowerShell) and includes intermediate findings that highlight a suspicious ScriptBlockId and a PowerShell ScriptBlock executed on a host by a user. The analytic story focuses on Malicious PowerShell, Command and Control, and Suspicious DNS Traffic. This detection aims to identify a rare C2 channel that leverages DNS TXT records to deliver commands, which can help bypass some network controls and evade simple DNS filters.