Skip to content
Threat Feed
Subscribe
critical advisory

Cobalt Strike: Suspicious DNS beaconing patterns

This detection addresses suspicious DNS query patterns associated with Cobalt Strike beaconing activity as documented by the SigmaHQ project.

Triage facts

Revision 1
Applicability
Windows
Evidence
Unknown
Severity
Critical
Action
Elevated
Sources
3 public sources
Freshness
Revision 1Nov 10, 03:35 UTC
Detection
1 rule
Source quality
B2Likely

This brief provides detection logic for identifying specific DNS query structures historically associated with Cobalt Strike beaconing. These query patterns are often observed during command and control (C2) communication when the beacon is configured to use DNS as a transport mechanism.

Recommendation

  • Enable the Microsoft-Windows-DNS Client/Operational event log to capture the telemetry required for this rule.
  • Deploy the provided Sigma rule to your SIEM to monitor for DNS queries matching known Cobalt Strike patterns.
  • Investigate any DNS queries identified by this rule for potential C2 activity, particularly those originating from unauthorized or sensitive internal hosts.

Immediate actions

Enable Microsoft-Windows-DNS Client/Operational logging across the fleet

IT Operations 48h

Deploy Sigma rule for Cobalt Strike DNS detection

Detection Engineering 24h

Threat Hunt

Search existing DNS logs for historical occurrences of .stage. or post.1 query prefixes

T1071.004 high high confidence hunt now

Data: DNS query logs

Detection coverage 1

Detect Suspicious Cobalt Strike DNS Beaconing

critical

Detects DNS queries known to be used by Cobalt Strike beacons based on naming patterns in the query string.

sigma tactics: command_and_control techniques: T1071.004 sources: dns_query, windows

Detection queries are available on the platform. Get full rules →