Windows DNS Client: Cobalt Strike DNS Beaconing Patterns via Suspicious Query Names

ATT&CK techniques

C2

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
- T1071.004DNS
Exfiltration
Impact

What it detects

This rule flags Windows DNS client events (EventID 3008) where the DNS query name matches patterns associated with Cobalt Strike beaconing. Attackers may use DNS to blend command-and-control traffic into normal resolution activity, making query-name anomalies a useful signal. The detection relies on Microsoft-Windows-DNS Client Operational log telemetry, specifically QueryName values in EventID 3008 events.

Reporting behind it

Related detections9 linkedT1071.004 — drag to rearrange

Suspicious Script Download via Curl and PowerShell by Dohdoor

DoT (DNS Over TLS) Activation - Command (via process_creation)

DoT (DNS Over TLS) Activation - PowerShell (via powershell)

Possible C2 Beacon with Fixed Authorization URI Parameter via proxy

Suspicious FinCounter DNS Tunneling Query via dns_query

Malicious SUNBURST Command and Control DNS Query to avsvmcloud Domain (via dns_query)

Suspicious Exploitation Callback to Dnslog Service (via dns_query)

Malicious Project CAV3RN DNS Configuration Recovery via cloudlanecdn.com (via dns_query)

Suspicious Entra Sign-In Interrupt With High Aggregated Risk via AiTM DNS Hijacking (via azure)

Windows DNS Client: Cobalt Strike DNS Beaconing Patterns via Suspicious Query Names

Pivot detection · T1071.004 · 9 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

suspicious-cobalt-strike-dns-beaconing-via-windows-dns-client-event-id-3008-0d18728b

title: "Windows DNS Client: Cobalt Strike DNS Beaconing Patterns via Suspicious Query Names"
id: 9299a457-dc2c-4ce3-b7d2-9aa38e79cc6c
related:
  - id: f356a9c4-effd-4608-bbf8-408afd5cd006
    type: similar
  - id: 0d18728b-f5bf-4381-9dcf-915539fff6c2
    type: derived
status: test
description: This rule flags Windows DNS client events (EventID 3008) where the DNS query name matches patterns associated with Cobalt Strike beaconing. Attackers may use DNS to blend command-and-control traffic into normal resolution activity, making query-name anomalies a useful signal. The detection relies on Microsoft-Windows-DNS Client Operational log telemetry, specifically QueryName values in EventID 3008 events.
references:
  - https://www.icebrg.io/blog/footprints-of-fin7-tracking-actor-patterns
  - https://www.sekoia.io/en/hunting-and-detecting-cobalt-strike/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/dns_client/win_dns_client_mal_cobaltstrike.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-01-16
tags:
  - attack.t1071.004
  - attack.command-and-control
logsource:
  product: windows
  service: dns-client
  definition: "Requirements: Microsoft-Windows-DNS Client Events/Operational Event Log must be enabled/collected in order to receive the events."
detection:
  selection_eid:
    EventID: 3008
  selection_query_1:
    QueryName|startswith:
      - aaa.stage.
      - post.1
  selection_query_2:
    QueryName|contains: .stage.123456.
  condition: selection_eid and 1 of selection_query_*
falsepositives:
  - Unknown
level: critical
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL