Suspicious DNS Beaconing Patterns Indicative of Cobalt Strike (DNS)

title: Suspicious DNS Beaconing Patterns Indicative of Cobalt Strike (DNS)
id: b43679c7-0aad-448b-b0a8-c7f79c8db99a
status: test
description: This rule identifies DNS queries that match specific formatting patterns associated with Cobalt Strike beaconing behavior. Attackers commonly use DNS to maintain command-and-control connectivity while blending into normal network traffic. The detection relies on DNS query name telemetry and flags queries that start with defined subdomain prefixes or contain a specific stage marker sequence.
references:
  - https://www.icebrg.io/blog/footprints-of-fin7-tracking-actor-patterns
  - https://www.sekoia.io/en/hunting-and-detecting-cobalt-strike/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/network/dns/net_dns_mal_cobaltstrike.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2018-05-10
modified: 2022-10-09
tags:
  - attack.command-and-control
  - attack.t1071.004
logsource:
  category: dns
detection:
  selection1:
    query|startswith:
      - aaa.stage.
      - post.1
  selection2:
    query|contains: .stage.123456.
  condition: 1 of selection*
falsepositives:
  - Unknown
level: critical
license: DRL-1.1
related:
  - id: 2975af79-28c4-4d2f-a951-9095f229df29
    type: derived