Rule Info
Name
Suspicious Cobalt Strike DNS Beaconing - DNS Client
Author
Nasreddine Bencherchali (Nextron Systems)
Description
Detects a program that invoked suspicious DNS queries known from Cobalt Strike beacons
Date
2023-01-16 00:00:00
Modified
None
Id
0d18728b-f5bf-4381-9dcf-915539fff6c2
Tags
attack.t1071.004 attack.command-and-control
Type
Community Rule
Link to Public Repo
Rule History
Author
Title
Date
Commit
Swachchhanda Shrawan Poudel
Merge PR #5740 from @swachchhanda000 - chore: reorganize threat specific rules into rules-emerging-threats directory
2025-11-10
Nasreddine Bencherchali
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12
Scan your endpoints, forensic images or collected files with our portable scanner THOR