Cobalt Strike Malicious Service Installations

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•2•0•48

Detects known malicious service installations associated with Cobalt Strike beacons, often used for privilege escalation or lateral movement. The rule specifically looks for patterns in the ServiceFileName field of Windows Security Event ID 4697, such as the presence of 'ADMIN$' and '.exe', '%COMSPEC%', 'start', and 'powershell', or encoded PowerShell commands often used by Cobalt Strike.