Skip to content
Threat Feed
Subscribe
high advisory

Cobalt Strike DNS Beaconing Patterns

Cobalt Strike beacons utilize specific, recognizable DNS query structures for command and control communication, which can be identified by analyzing network-level DNS telemetry.

Triage facts

Revision 1
Evidence
Unknown
Severity
High
Action
Elevated
Sources
1 public source
Freshness
Revision 1Nov 10, 02:40 UTC
Detection
1 rule
Source quality
B2Likely

Cobalt Strike beacons leverage DNS for C2 operations, often encoding command and control data within DNS query strings. These queries exhibit consistent patterns and subdomains that can be detected via DNS traffic analysis.

Impact

The use of DNS for C2 allows attackers to maintain stealthy, long-term persistence and communication channels, potentially bypassing traditional firewalls that permit outbound DNS traffic.

Recommendation

  • Deploy the provided Sigma rule to your SIEM/log analysis platform to identify known Cobalt Strike DNS beaconing query patterns.
  • Baseline internal DNS request volume to identify anomalous, high-frequency, or patterned subdomains that deviate from typical host traffic.
  • Implement DNS filtering and sinkholing for identified malicious domains if discovered in your network telemetry.

Immediate actions

Deploy Sigma rule to detect Cobalt Strike patterns in DNS logs

Detection Engineering 48h

Threat Hunt

Identify high-frequency DNS query anomalies

T1071.004 medium medium confidence hunt now

Data: DNS query logs, source_ip

Detection coverage 1

Detect Cobalt Strike DNS Beaconing

high

Detects suspicious DNS queries known from Cobalt Strike beacons that use specific patterns for C2 communication

sigma tactics: command-and-control techniques: T1071.004 sources: dns_query

Detection queries are available on the platform. Get full rules →