Suspicious Cobalt Strike-Style DNS Beaconing via Sysmon on Windows

title: Suspicious Cobalt Strike-Style DNS Beaconing via Sysmon on Windows
id: 2784796c-66ca-4702-aa46-b7d67fb68e49
related:
  - id: 0d18728b-f5bf-4381-9dcf-915539fff6c2
    type: similar
  - id: f356a9c4-effd-4608-bbf8-408afd5cd006
    type: derived
status: test
description: This rule flags DNS queries whose QueryName matches patterns associated with Cobalt Strike beaconing domains. Attackers may use DNS to maintain command-and-control communications while blending with normal network traffic. It relies on Windows DNS query telemetry from Sysmon, specifically the QueryName content and its matching patterns (prefixes and an exact substring).
references:
  - https://www.icebrg.io/blog/footprints-of-fin7-tracking-actor-patterns
  - https://www.sekoia.io/en/hunting-and-detecting-cobalt-strike/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/dns_query/dns_query_win_mal_cobaltstrike.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2021-11-09
modified: 2023-01-16
tags:
  - attack.command-and-control
  - attack.t1071.004
logsource:
  product: windows
  category: dns_query
detection:
  selection1:
    QueryName|startswith:
      - aaa.stage.
      - post.1
  selection2:
    QueryName|contains: .stage.123456.
  condition: 1 of selection*
falsepositives:
  - Unknown
level: critical
license: DRL-1.1