Cobalt Strike DNS Beaconing

Title: Cobalt Strike DNS Beaconing
Status: test
Description:Detects suspicious DNS queries known from Cobalt Strike beacons
References:
  -https://www.icebrg.io/blog/footprints-of-fin7-tracking-actor-patterns
  -https://www.sekoia.io/en/hunting-and-detecting-cobalt-strike/
Author: Florian Roth (Nextron Systems)
Date: 2018-05-10
modified:2022-10-09
Tags:

• -'attack.command-and-control'
• -'attack.t1071.004'

Logsource:

• category: dns

Detection:
  selection1:
    query|startswith:
      -'aaa.stage.'
      -'post.1'

  selection2:
    query|contains: '.stage.123456.'
  condition:1 of selection*
Falsepositives:
  -Unknown
Level: critical