Potential Cobalt Strike Process Patterns
Detects potential process patterns related to Cobalt Strike beacon activity. This includes specific command-line executions like 'whoami' from the C:\Temp\ directory, or 'cmd.exe /c echo' piping output to a named pipe when the parent process is 'runonce.exe' or 'dllhost.exe'. It also identifies 'conhost.exe' being spawned with particular arguments in conjunction with these suspicious parent command lines.
Sigma
