Cobalt Strike-style DNS Beaconing Queries (DNS)

ATT&CK techniques

C2

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
- T1071.004DNS
Exfiltration
Impact

What it detects

This rule flags DNS queries with patterns commonly associated with Cobalt Strike beaconing, including specific query prefixes and a distinctive substring marker. Such DNS-based communication can blend into normal traffic while providing an attacker a resilient command-and-control channel. It relies on DNS query telemetry, matching on query string prefix and substring content.

Reporting behind it

Related detections9 linkedT1071.004 — drag to rearrange

Suspicious Script Download via Curl and PowerShell by Dohdoor

DoT (DNS Over TLS) Activation - Command (via process_creation)

DoT (DNS Over TLS) Activation - PowerShell (via powershell)

Possible C2 Beacon with Fixed Authorization URI Parameter via proxy

Suspicious FinCounter DNS Tunneling Query via dns_query

Malicious SUNBURST Command and Control DNS Query to avsvmcloud Domain (via dns_query)

Suspicious Exploitation Callback to Dnslog Service (via dns_query)

Malicious Project CAV3RN DNS Configuration Recovery via cloudlanecdn.com (via dns_query)

Suspicious Entra Sign-In Interrupt With High Aggregated Risk via AiTM DNS Hijacking (via azure)

Cobalt Strike-style DNS Beaconing Queries (DNS)

Pivot detection · T1071.004 · 9 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

suspicious-dns-beaconing-patterns-indicative-of-cobalt-strike-dns-2975af79

title: Cobalt Strike-style DNS Beaconing Queries (DNS)
id: b43679c7-0aad-448b-b0a8-c7f79c8db99a
status: test
description: This rule flags DNS queries with patterns commonly associated with Cobalt Strike beaconing, including specific query prefixes and a distinctive substring marker. Such DNS-based communication can blend into normal traffic while providing an attacker a resilient command-and-control channel. It relies on DNS query telemetry, matching on query string prefix and substring content.
references:
  - https://www.icebrg.io/blog/footprints-of-fin7-tracking-actor-patterns
  - https://www.sekoia.io/en/hunting-and-detecting-cobalt-strike/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/network/dns/net_dns_mal_cobaltstrike.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2018-05-10
modified: 2022-10-09
tags:
  - attack.command-and-control
  - attack.t1071.004
logsource:
  category: dns
detection:
  selection1:
    query|startswith:
      - aaa.stage.
      - post.1
  selection2:
    query|contains: .stage.123456.
  condition: 1 of selection*
falsepositives:
  - Unknown
level: critical
license: DRL-1.1
related:
  - id: 2975af79-28c4-4d2f-a951-9095f229df29
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL