Suspicious Cobalt Strike DNS Beaconing via Windows DNS Client (Event ID 3008)

title: Suspicious Cobalt Strike DNS Beaconing via Windows DNS Client (Event ID 3008)
id: 9299a457-dc2c-4ce3-b7d2-9aa38e79cc6c
related:
  - id: f356a9c4-effd-4608-bbf8-408afd5cd006
    type: similar
  - id: 0d18728b-f5bf-4381-9dcf-915539fff6c2
    type: derived
status: test
description: This rule flags Windows DNS client activity (Event ID 3008) where DNS query names match patterns associated with Cobalt Strike beaconing. Attackers use beacon-like DNS lookups for command-and-control while blending into normal name resolution traffic. The detection relies on DNS client operational telemetry containing the DNS query name (QueryName) and the specific event identifier.
references:
  - https://www.icebrg.io/blog/footprints-of-fin7-tracking-actor-patterns
  - https://www.sekoia.io/en/hunting-and-detecting-cobalt-strike/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/dns_client/win_dns_client_mal_cobaltstrike.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-01-16
tags:
  - attack.t1071.004
  - attack.command-and-control
logsource:
  product: windows
  service: dns-client
  definition: "Requirements: Microsoft-Windows-DNS Client Events/Operational Event Log must be enabled/collected in order to receive the events."
detection:
  selection_eid:
    EventID: 3008
  selection_query_1:
    QueryName|startswith:
      - aaa.stage.
      - post.1
  selection_query_2:
    QueryName|contains: .stage.123456.
  condition: selection_eid and 1 of selection_query_*
falsepositives:
  - Unknown
level: critical
license: DRL-1.1