Sigma detection rules, expert-reviewed

Suspicious Telegram Bot API C2 Beaconing (via network)

This rule detects outbound HTTP requests to the Telegram bot API using sendPhoto and sendDocument methods which the CoralRaider actor abuses for command and control and exfiltration of stolen social media data. Abusing a legitimate messaging platform lets attackers hide C2 inside allowed web traffic and defeat domain reputation controls.

Proxy Traffic to Operation Triangulation Domains Indicative of C2 Beaconing

Alerts on proxy requests to specific suspect C2-related domains by host substring match.

Suspicious DNS Queries to Operation Triangulation-Like Domains for C2 Beaconing

Detects DNS queries to known Operation Triangulation-related domains that may indicate C2 beaconing.

Proxy Beaconing to 3CX-Related Domains Indicating Possible Compromise

Flags proxy requests to 3CX-related domains that may indicate C2 beaconing behavior.

Windows 3CXDesktopApp.exe Beaconing to Suspicious 3CX-Related Domains (Netcon)

Potential Compromised 3CXDesktopApp Beaconing Activity - Netcon

Windows DNS: Detect potential beaconing to domains associated with 3CXDesktopApp compromise

Potential Compromised 3CXDesktopApp Beaconing Activity - DNS

Windows DNS Client: Cobalt Strike DNS Beaconing Patterns via Suspicious Query Names

Alerts when Windows DNS client logs show Event ID 3008 DNS queries matching Cobalt Strike beacon patterns.

Suspicious DNS Query Patterns for Cobalt Strike Beacons on Windows (Sysmon)

Alerts on Windows Sysmon DNS queries with QueryName patterns consistent with Cobalt Strike DNS beaconing.

Windows Security 4697 Alerts for Service Installations Using Cobalt Strike Beacon Payloads

Flags Windows Event 4697 service installs whose service command strings match hidden/encoded PowerShell payload patterns.

Cobalt Strike-style DNS Beaconing Queries (DNS)

Flags DNS queries with Cobalt Strike-style stage subdomain patterns used for covert beaconing.