Windows DNS Client: Cobalt Strike DNS Beaconing Patterns via Suspicious Query Names

Alerts when Windows DNS client logs show Event ID 3008 DNS queries matching Cobalt Strike beacon patterns.

FreeReviewedSigma · Critical · v2

Product: windows
Service: dns-client
Author: Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2023-01-16
Updated: 2026-07-31

ATT&CK techniques

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
- T1071.004DNS
Exfiltration
Impact

What it detects

This rule flags Windows DNS client events (EventID 3008) where the DNS query name matches patterns associated with Cobalt Strike beaconing. Attackers may use DNS to blend command-and-control traffic into normal resolution activity, making query-name anomalies a useful signal. The detection relies on Microsoft-Windows-DNS Client Operational log telemetry, specifically QueryName values in EventID 3008 events.

Reporting behind it

Related detections9 linkedT1071.004 — drag to rearrange

Malicious GS-Netcat Command and Control via Global Socket Relay Network (via dns_query)

Suspicious DNS Query to Dynamic DNS and Tunneling Providers Abused by RATs

Suspicious UPSTYLE Command Channel Pattern in Web Requests via CVE-2024-3400

Suspicious DNS C2 to Microsoft Typosquat Domain

Suspicious DNS Queries to Simitor Tracking Tunnel Infrastructure

Suspicious DNS Queries to Secshow Open Resolver Scanning Infrastructure

Suspicious OpenMetadata Exploit Interactsh OAST Callback (via process_creation)

Suspicious Outlook Process Spawning Network Utilities for NotDoor C2 (via process_creation)

Malicious DNS Query To fdmpkg C2 Domain via DNS Query

Windows DNS Client: Cobalt Strike DNS Beaconing Patterns via Suspicious Query Names

Pivot detection · T1071.004 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

suspicious-cobalt-strike-dns-beaconing-via-windows-dns-client-event-id-3008-0d18728b

title: "Windows DNS Client: Cobalt Strike DNS Beaconing Patterns via Suspicious Query Names"
id: 9299a457-dc2c-4ce3-b7d2-9aa38e79cc6c
related:
  - id: f356a9c4-effd-4608-bbf8-408afd5cd006
    type: similar
  - id: 0d18728b-f5bf-4381-9dcf-915539fff6c2
    type: derived
status: test
description: This rule flags Windows DNS client events (EventID 3008) where the DNS query name matches patterns associated with Cobalt Strike beaconing. Attackers may use DNS to blend command-and-control traffic into normal resolution activity, making query-name anomalies a useful signal. The detection relies on Microsoft-Windows-DNS Client Operational log telemetry, specifically QueryName values in EventID 3008 events.
references:
  - https://www.icebrg.io/blog/footprints-of-fin7-tracking-actor-patterns
  - https://www.sekoia.io/en/hunting-and-detecting-cobalt-strike/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/dns_client/win_dns_client_mal_cobaltstrike.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-01-16
tags:
  - attack.t1071.004
  - attack.command-and-control
logsource:
  product: windows
  service: dns-client
  definition: "Requirements: Microsoft-Windows-DNS Client Events/Operational Event Log must be enabled/collected in order to receive the events."
detection:
  selection_eid:
    EventID: 3008
  selection_query_1:
    QueryName|startswith:
      - aaa.stage.
      - post.1
  selection_query_2:
    QueryName|contains: .stage.123456.
  condition: selection_eid and 1 of selection_query_*
falsepositives:
  - Unknown
level: critical
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL