Suspicious Cobalt Strike DNS Beaconing - Sysmon

Title: Suspicious Cobalt Strike DNS Beaconing - Sysmon
Status: test
Description:Detects a program that invoked suspicious DNS queries known from Cobalt Strike beacons
References:
  -https://www.icebrg.io/blog/footprints-of-fin7-tracking-actor-patterns
  -https://www.sekoia.io/en/hunting-and-detecting-cobalt-strike/
Author: Florian Roth (Nextron Systems)
Date: 2021-11-09
modified:2023-01-16
Tags:

• -'attack.command-and-control'
• -'attack.t1071.004'

Logsource:

• product: windows
• category: dns_query

Detection:
  selection1:
    QueryName|startswith:
      -'aaa.stage.'
      -'post.1'

  selection2:
    QueryName|contains: '.stage.123456.'
  condition:1 of selection*
Falsepositives:
  -Unknown
Level: critical