critical
advisory
Cobalt Strike DNS Beaconing Patterns
Detection of suspicious DNS query patterns associated with Cobalt Strike command and control communication.
Triage facts
Revision 1- Evidence
- Unknown
- Severity
- Critical
- Sources
- 3 public sources
- Freshness
- Revision 1Nov 10, 03:38 UTC
- Detection
- 1 rule
- Source quality
- A2Roughly even chance
This brief identifies specific DNS query naming conventions associated with Cobalt Strike beacons. Detection is based on Sysmon DNS query logging.
Detection Logic
The detection identifies programs invoking DNS queries with the following naming patterns:
- Queries starting with "aaa.stage." or "post.1"
- Queries containing ".stage.123456."
Detection coverage 1
Detect Suspicious Cobalt Strike DNS Beaconing
criticalDetects a program that invoked suspicious DNS queries known from Cobalt Strike beacons.
sigma
tactics: command_and_control
techniques: T1071.004
sources: dns_query, windows
Detection queries are available on the platform. Get full rules →