Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
151 detections
Filters
Last updated
All Time
Detection languages
50
38
24
23
7
Contributors
40
31
25
23
9
Categories
46
30
28
26
26
Platforms
116
34
4
1
1
Products / Services
48
36
27
23
22
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
CVEs
2
1
1
IDS Classtypes
17
6
IDS Protocols
18
3
1
1
The following analytic identifies the execution of rundll32.exe with the DLL function names "Start" and "StartW," commonly associated with Cobalt Strike payloads. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions and process metadata. This activity is significant as it often indicates the presence of malicious payloads, such as Cobalt Strike, which can lead to unauthorized code execution. If confirmed malicious, this activity could allow attackers to inject shellcode, escalate privileges, and maintain persistence within the environment.
Detects the creation of named pipes associated with default Cobalt Strike malleable profiles and common open-source C2 frameworks (e.g., Sliver, Havoc) via EDR pipe-creation telemetry. These pipes are frequently used for SMB beacon communication within compromised networks.
This rule detects network beaconing behavior consistent with Cobalt Strike's default malleable C2 profiles. It monitors HTTP GET and POST requests for specific URI patterns commonly used by default Cobalt Strike configurations and triggers when multiple such requests are observed from a single host over a 15-minute window.
Detects HTTP beacon traffic patterns indicative of Cobalt Strike malleable C2 profiles using default URI paths and User-Agent strings. This rule identifies common default configurations often left unchanged during adversarial deployment, allowing for the detection of beacon communication over HTTP.
Detects network traffic indicators associated with Cobalt Strike beaconing activity, specifically focusing on common default or near-default Malleable C2 HTTP profile patterns. This includes hardcoded URI paths often used in default configurations (e.g., jQuery library names, pixel gifs) and specific combinations of HTTP headers and user-agent strings commonly observed in adversary C2 frameworks.
Detects indicators of Cobalt Strike activity, including the creation of default named pipes, process injection into common LOLBins without legitimate parent processes, and network communication patterns consistent with Cobalt Strike malleable C2 profiles.
Detects potential C2 beaconing activity by identifying repeated network connections to the same external host that exhibit consistent payload sizes (low variance) and frequency, or by flagging HTTP requests containing default URI patterns associated with Cobalt Strike profiles.
Detects network traffic patterns associated with a specific Cobalt Strike Malleable C2 profile (jquery-cookie), characterized by GET requests to URIs starting with /jquery- with a specific Cookie header structure and the absence of an Accept header.
Detects remote thread creation (CreateRemoteThread or QueueUserAPC) into common Windows system processes (rundll32.exe or svchost.exe) originating from suspicious source processes. This activity is indicative of process injection techniques commonly utilized by Cobalt Strike beacons during post-exploitation, lateral movement, or ransomware deployment phases.
Detects known Cobalt Strike default named pipe naming conventions and cross-process reflective DLL injection activities into common Windows host processes such as rundll32.exe, svchost.exe, and others. This rule monitors for suspicious named pipe creation events and process memory manipulation patterns indicative of beacon behavior and post-exploitation injection.
Detects outbound network traffic exhibiting the default self-signed TLS certificate subject and issuer fields 'O=Cobalt Strike' combined with the known default JA3 fingerprint '72a589da586844d7f0818ce684948eea' associated with Cobalt Strike C2 communication.
Detects the creation of named pipes associated with default Cobalt Strike malleable profiles and common open-source C2 frameworks (e.g., Sliver, Havoc) via EDR pipe-creation telemetry. These pipes are frequently used for SMB beacon communication within compromised networks.
Detects the creation or connection of named pipes that match known default and common malleable C2 profile patterns used by the Cobalt Strike post-exploitation framework. These named pipes are frequently utilized by Cobalt Strike beacons for inter-process communication, SMB/TCP beacon functionality, and staging during post-exploitation activities.
Detects DNS queries with abnormally long subdomains matching patterns frequently used by Cobalt Strike DNS Beacons for command-and-control communications. The rule identifies hexadecimal or base32 encoded strings within subdomains that exceed 40 characters in length and occur frequently within a short time window.
Detects network communication to a known malicious IP address (45.32.253.166) associated with the PIVOTPIPE RAT using Cobalt Strike C2 beaconing patterns. The rule identifies TCP connections, HTTP GET requests for beacon check-ins, and HTTP POST requests for task responses.
Detects network connections originating from or connecting to hosts that utilize known Cobalt Strike default JA3 or JA3S TLS fingerprints. These fingerprints are indicative of Cobalt Strike's default beacon communication patterns.
Detects the creation of specific debug log files by PIVOTPIPE Cobalt Strike-compatible payloads in the Windows temporary directory. These artifacts indicate active post-exploitation activity, specifically operations involving process token manipulation or impersonation.
Detects the execution of known PIVOTPIPE beacon binaries by matching against specific file names and SHA256 hashes. These binaries are associated with post-exploitation activities and internal network pivoting.
Detects network traffic consistent with PIVOTPIPE command-and-control activity and potential Cobalt Strike beaconing to known malicious infrastructure on specific ports.
This rule detects the creation of named pipes with names that match default or commonly customized patterns used by Cobalt Strike Beacons for inter-process communication (IPC) and lateral movement. The detection specifically targets common pipe naming conventions such as those starting with 'msagent_', 'MSSE-', 'postex_', 'status_', and 'mypipe-', which are frequently observed in Cobalt Strike configurations.
Detects outbound network traffic from internal hosts to a known Cobalt Strike-compatible C2 server at 45.32.253.166 on port 8088. This activity is indicative of a compromised host establishing a command-and-control connection.
Page 1 of 8