Suspicious DNS Query Patterns for Cobalt Strike Beacons on Windows (Sysmon)

ATT&CK techniques

C2

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
- T1071.004DNS
Exfiltration
Impact

What it detects

This rule flags Windows Sysmon DNS query events where the QueryName matches patterns associated with Cobalt Strike beaconing. Attackers may use DNS to blend command-and-control traffic into normal network activity. Detection relies on telemetry containing DNS query names and checks for specific prefixes and substrings indicative of beacon-style domains.

Reporting behind it

Related detections9 linkedT1071.004 — drag to rearrange

Suspicious Script Download via Curl and PowerShell by Dohdoor

DoT (DNS Over TLS) Activation - Command (via process_creation)

DoT (DNS Over TLS) Activation - PowerShell (via powershell)

Possible C2 Beacon with Fixed Authorization URI Parameter via proxy

Suspicious FinCounter DNS Tunneling Query via dns_query

Malicious SUNBURST Command and Control DNS Query to avsvmcloud Domain (via dns_query)

Suspicious Exploitation Callback to Dnslog Service (via dns_query)

Malicious Project CAV3RN DNS Configuration Recovery via cloudlanecdn.com (via dns_query)

Suspicious Entra Sign-In Interrupt With High Aggregated Risk via AiTM DNS Hijacking (via azure)

Suspicious DNS Query Patterns for Cobalt Strike Beacons on Windows (Sysmon)

Pivot detection · T1071.004 · 9 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

suspicious-cobalt-strike-style-dns-beaconing-via-sysmon-on-windows-f356a9c4

title: Suspicious DNS Query Patterns for Cobalt Strike Beacons on Windows (Sysmon)
id: 2784796c-66ca-4702-aa46-b7d67fb68e49
related:
  - id: 0d18728b-f5bf-4381-9dcf-915539fff6c2
    type: similar
  - id: f356a9c4-effd-4608-bbf8-408afd5cd006
    type: derived
status: test
description: This rule flags Windows Sysmon DNS query events where the QueryName matches patterns associated with Cobalt Strike beaconing. Attackers may use DNS to blend command-and-control traffic into normal network activity. Detection relies on telemetry containing DNS query names and checks for specific prefixes and substrings indicative of beacon-style domains.
references:
  - https://www.icebrg.io/blog/footprints-of-fin7-tracking-actor-patterns
  - https://www.sekoia.io/en/hunting-and-detecting-cobalt-strike/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/dns_query/dns_query_win_mal_cobaltstrike.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2021-11-09
modified: 2023-01-16
tags:
  - attack.command-and-control
  - attack.t1071.004
logsource:
  product: windows
  category: dns_query
detection:
  selection1:
    QueryName|startswith:
      - aaa.stage.
      - post.1
  selection2:
    QueryName|contains: .stage.123456.
  condition: 1 of selection*
falsepositives:
  - Unknown
level: critical
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL