Suspicious Cobalt Strike DNS Beaconing - DNS Client

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•29

This rule detects suspicious DNS queries that are characteristic of Cobalt Strike beaconing activity. Specifically, it looks for DNS queries with names starting with 'aaa.stage.' or 'post.1', or containing '.stage.123456.'. These patterns are known indicators of Cobalt Strike's DNS communication for staging or command and control.