[T1059.001] NSLookup Remote Payload

Detect PowerShell-spawned nslookup.exe queries using -q=txt, often used for remote payload retrieval, mapped to MITRE ATT&CK T1059.001.