Windows process access matching Cobalt Strike BOF injection call trace
Flags suspicious Windows process access consistent with CobaltStrike BOF injection using ntdll/KERNELBASE call traces and high GrantedAccess.
- Product
- windows
- Category
- process_access
- Author
- Christian Burkard (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2021-08-04
- Updated
- 2026-07-31
ATT&CK techniques
ExecutionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows process access events where the CallTrace matches a specific ntdll→KERNELBASE chain ending in an UNKNOWN address pattern, along with granted access values consistent with injection-style access. Attackers commonly use process injection to run code in the context of other processes while evading simpler defenses. It relies on process access telemetry that includes a CallTrace string and the GrantedAccess mask for the access attempt.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows process access matching Cobalt Strike BOF injection call trace
id: 8f1fe27c-8402-4cb8-8945-1358836bc4b3
status: test
description: This rule flags Windows process access events where the CallTrace matches a specific ntdll→KERNELBASE chain ending in an UNKNOWN address pattern, along with granted access values consistent with injection-style access. Attackers commonly use process injection to run code in the context of other processes while evading simpler defenses. It relies on process access telemetry that includes a CallTrace string and the GrantedAccess mask for the access attempt.
references:
- https://github.com/boku7/injectAmsiBypass
- https://github.com/boku7/spawn
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_access/proc_access_win_hktl_cobaltstrike_bof_injection_pattern.yml
author: Christian Burkard (Nextron Systems), Huntrule Team
date: 2021-08-04
modified: 2023-11-28
tags:
- attack.execution
- attack.defense-impairment
- attack.t1106
- attack.t1685
logsource:
category: process_access
product: windows
detection:
selection:
CallTrace|re: ^C:\\Windows\\SYSTEM32\\ntdll\.dll\+[a-z0-9]{4,6}\|C:\\Windows\\System32\\KERNELBASE\.dll\+[a-z0-9]{4,6}\|UNKNOWN\([A-Z0-9]{16}\)$
GrantedAccess:
- "0x1028"
- "0x1fffff"
condition: selection
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 09706624-b7f6-455d-9d02-adee024cee1d
type: derived