Operator Bloopers Cobalt Strike Modules

Title: Operator Bloopers Cobalt Strike Modules
Status: test
Description:Detects Cobalt Strike module/commands accidentally entered in CMD shell
References:
  -https://hstechdocs.helpsystems.com/manuals/cobaltstrike/current/userguide/content/cobalt-4-5-user-guide.pdf
  -https://thedfirreport.com/2021/10/04/bazarloader-and-the-conti-leaks/
  -https://thedfirreport.com/2022/06/16/sans-ransomware-summit-2022-can-you-detect-this/
Author: _pete_0, TheDFIRReport
Date: 2022-05-06
modified:2023-01-30
Tags:

• -'attack.execution'
• -'attack.t1059.003'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_img:
OriginalFileName:'Cmd.Exe' Image|endswith:'\cmd.exe'   selection_cli:
    CommandLine|contains:
      -'Invoke-UserHunter'
      -'Invoke-ShareFinder'
      -'Invoke-Kerberoast'
      -'Invoke-SMBAutoBrute'
      -'Invoke-Nightmare'
      -'zerologon'
      -'av_query'

  condition:all of selection_*
Falsepositives:
  -Unknown
Level: high