Cobalt Strike Module Command-Line Bloopers

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•14

Detects command-line arguments that are characteristic of Cobalt Strike modules or commands, which may indicate an operator error where these commands are accidentally typed into a command prompt instead of the Cobalt Strike console. This rule specifically looks for common 'Invoke-' PowerShell module names and other Cobalt Strike related keywords executed via 'cmd.exe'.