Suspicious Cobalt Strike DNS Beaconing - DNS Client

Title: Suspicious Cobalt Strike DNS Beaconing - DNS Client
Status: test
Description:Detects a program that invoked suspicious DNS queries known from Cobalt Strike beacons
References:
  -https://www.icebrg.io/blog/footprints-of-fin7-tracking-actor-patterns
  -https://www.sekoia.io/en/hunting-and-detecting-cobalt-strike/
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-01-16
modified:None
Tags:

• -'attack.t1071.004'
• -'attack.command-and-control'

Logsource:

• product: windows
• service: dns-client
• definition: Requirements: Microsoft-Windows-DNS Client Events/Operational Event Log must be enabled/collected in order to receive the events.

Detection:
  selection_eid:
    EventID: '3008'
  selection_query_1:
    QueryName|startswith:
      -'aaa.stage.'
      -'post.1'

  selection_query_2:
    QueryName|contains: '.stage.123456.'
  condition:selection_eid and 1 of selection_query_*
Falsepositives:
  -Unknown
Level: critical