Cobalt Strike DNS Beaconing Detection

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•56

This rule detects suspicious DNS queries that are characteristic of Cobalt Strike beacons. Specifically, it looks for DNS queries starting with 'aaa.stage.' or 'post.1', or containing '.stage.123456.'. These patterns are known indicators of Cobalt Strike's DNS command and control (C2) communication.