Every published rule

Proxy Traffic to Operation Triangulation Domains Indicative of C2 Beaconing

Alerts on proxy requests to specific suspect C2-related domains by host substring match.

Suspicious DNS Queries to Operation Triangulation-Like Domains for C2 Beaconing

Detects DNS queries to known Operation Triangulation-related domains that may indicate C2 beaconing.

Proxy Beaconing to 3CX-Related Domains Indicating Possible Compromise

Flags proxy requests to 3CX-related domains that may indicate C2 beaconing behavior.

Windows 3CXDesktopApp.exe Beaconing to Suspicious 3CX-Related Domains (Netcon)

Potential Compromised 3CXDesktopApp Beaconing Activity - Netcon

Windows DNS: Detect potential beaconing to domains associated with 3CXDesktopApp compromise

Potential Compromised 3CXDesktopApp Beaconing Activity - DNS

Windows DNS Client: Cobalt Strike DNS Beaconing Patterns via Suspicious Query Names

Alerts when Windows DNS client logs show Event ID 3008 DNS queries matching Cobalt Strike beacon patterns.

Suspicious DNS Query Patterns for Cobalt Strike Beacons on Windows (Sysmon)

Alerts on Windows Sysmon DNS queries with QueryName patterns consistent with Cobalt Strike DNS beaconing.

Windows Security 4697 Alerts for Service Installations Using Cobalt Strike Beacon Payloads

Flags Windows Event 4697 service installs whose service command strings match hidden/encoded PowerShell payload patterns.

Cobalt Strike-style DNS Beaconing Queries (DNS)

Flags DNS queries with Cobalt Strike-style stage subdomain patterns used for covert beaconing.