Elastic high stable kql

Cobalt Strike Command and Control Beacon

Cobalt Strike is a threat emulation platform commonly modified and used by adversaries to conduct network attack and exploitation campaigns. This rule detects a network activity algorithm leveraged by Cobalt Strike implant beacons for command and control.

View Source

Detection Logic

from packetbeat-*, filebeat-*, logs-network_traffic.*, logs-panw.panos*, logs-fortinet_fortigate.log-* metadata _id, _version, _index
| where (
    (event.category in ("network", "network_traffic") and network.protocol in ("tls", "http")) or
    (data_stream.dataset == "panw.panos" and network.application in ("ssl", "web-browsing")) or
    data_stream.dataset in ("network_traffic.tls", "network_traffic.http", "fortinet_fortigate.log")
  )
| where destination.domain RLIKE "[a-z]{3}\\.stage\\.[0-9]{8}\\..*"
| keep @timestamp, destination.domain, source.ip, destination.ip, network.protocol, data_stream.dataset, _id, _version, _index

False Positives

⚠ This rule should be tailored to either exclude systems, as sources or destinations, in which this behavior is expected.

Field Validations

Loading…

Comments (0)

Loading comments...