Windows command line contains Cobalt Strike module commands entered in cmd.exe

title: Windows command line contains Cobalt Strike module commands entered in cmd.exe
id: 56ba3d8c-cbd8-4df7-979c-7d9df5484661
related:
  - id: 647c7b9e-d784-4fda-b9a0-45c565a7b729
    type: similar
  - id: 4f154fb6-27d1-4813-a759-78b93e0b9c48
    type: derived
status: test
description: This rule flags Windows process creation events where cmd.exe command lines contain strings associated with Cobalt Strike-related module usage. Such entries can indicate operator mistakes that expose tooling or preparation steps, and they can also reflect real attempts to run offensive modules from the Windows command shell. The detection relies on process creation telemetry including OriginalFileName and the full CommandLine content.
references:
  - https://hstechdocs.helpsystems.com/manuals/cobaltstrike/current/userguide/content/cobalt-4-5-user-guide.pdf
  - https://thedfirreport.com/2021/10/04/bazarloader-and-the-conti-leaks/
  - https://thedfirreport.com/2022/06/16/sans-ransomware-summit-2022-can-you-detect-this/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_cobaltstrike_bloopers_modules.yml
author: _pete_0, TheDFIRReport, Huntrule Team
date: 2022-05-06
modified: 2023-01-30
tags:
  - attack.execution
  - attack.t1059.003
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - OriginalFileName: Cmd.Exe
    - Image|endswith: \cmd.exe
  selection_cli:
    CommandLine|contains:
      - Invoke-UserHunter
      - Invoke-ShareFinder
      - Invoke-Kerberoast
      - Invoke-SMBAutoBrute
      - Invoke-Nightmare
      - zerologon
      - av_query
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1