Cobalt Strike-style DNS Beaconing Queries (DNS)

Flags DNS queries with Cobalt Strike-style stage subdomain patterns used for covert beaconing.

FreeReviewedSigma · Critical · v2

Category: dns
Author: Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2018-05-10
Updated: 2026-07-31

ATT&CK techniques

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
- T1071.004DNS
Exfiltration
Impact

What it detects

This rule flags DNS queries with patterns commonly associated with Cobalt Strike beaconing, including specific query prefixes and a distinctive substring marker. Such DNS-based communication can blend into normal traffic while providing an attacker a resilient command-and-control channel. It relies on DNS query telemetry, matching on query string prefix and substring content.

Reporting behind it

Related detections9 linkedT1071.004 — drag to rearrange

Malicious GS-Netcat Command and Control via Global Socket Relay Network (via dns_query)

Suspicious DNS Query to Dynamic DNS and Tunneling Providers Abused by RATs

Suspicious UPSTYLE Command Channel Pattern in Web Requests via CVE-2024-3400

Suspicious DNS C2 to Microsoft Typosquat Domain

Suspicious DNS Queries to Simitor Tracking Tunnel Infrastructure

Suspicious DNS Queries to Secshow Open Resolver Scanning Infrastructure

Suspicious OpenMetadata Exploit Interactsh OAST Callback (via process_creation)

Suspicious Outlook Process Spawning Network Utilities for NotDoor C2 (via process_creation)

Malicious DNS Query To fdmpkg C2 Domain via DNS Query

Cobalt Strike-style DNS Beaconing Queries (DNS)

Pivot detection · T1071.004 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

suspicious-dns-beaconing-patterns-indicative-of-cobalt-strike-dns-2975af79

title: Cobalt Strike-style DNS Beaconing Queries (DNS)
id: b43679c7-0aad-448b-b0a8-c7f79c8db99a
status: test
description: This rule flags DNS queries with patterns commonly associated with Cobalt Strike beaconing, including specific query prefixes and a distinctive substring marker. Such DNS-based communication can blend into normal traffic while providing an attacker a resilient command-and-control channel. It relies on DNS query telemetry, matching on query string prefix and substring content.
references:
  - https://www.icebrg.io/blog/footprints-of-fin7-tracking-actor-patterns
  - https://www.sekoia.io/en/hunting-and-detecting-cobalt-strike/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/network/dns/net_dns_mal_cobaltstrike.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2018-05-10
modified: 2022-10-09
tags:
  - attack.command-and-control
  - attack.t1071.004
logsource:
  category: dns
detection:
  selection1:
    query|startswith:
      - aaa.stage.
      - post.1
  selection2:
    query|contains: .stage.123456.
  condition: 1 of selection*
falsepositives:
  - Unknown
level: critical
license: DRL-1.1
related:
  - id: 2975af79-28c4-4d2f-a951-9095f229df29
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL