Suspicious Cobalt Strike DNS Beaconing

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•34

This rule detects suspicious DNS queries that are characteristic of Cobalt Strike beacons. Specifically, it looks for DNS query names starting with 'aaa.stage.' or 'post.1', or containing '.stage.123456.'. These patterns are known indicators of Cobalt Strike's DNS communication for staging or command and control.