Cobalt Strike BOF Process Injection Pattern
Detects a typical pattern of a Cobalt Strike Beacon Object File (BOF) attempting to inject into other processes. This rule specifically looks for process access events where the call trace indicates a sequence from ntdll.dll to KERNELBASE.dll, followed by an unknown module, combined with specific granted access rights (0x1028 or 0x1fffff). This pattern is indicative of certain process injection techniques used by Cobalt Strike BOFs.
Sigma
