Cobalt Strike Commands in CMD Shell
Detects the use of Cobalt Strike commands entered into the command shell. This rule specifically looks for common Cobalt Strike post-exploitation commands such as 'psinject', 'spawnas', 'make_token', 'remote-exec', 'rev2self', 'dcsync', 'logonpasswords', 'execute-assembly', and 'getsystem' when executed via cmd.exe. This often indicates an operator error where Cobalt Strike commands are mistakenly typed directly into a compromised system's command prompt instead of the Cobalt Strike beacon console.
Sigma
