Rule Info
Name
Suspicious Cobalt Strike DNS Beaconing - DNS Client
Author
Nasreddine Bencherchali (Nextron Systems)
Description
Detects a program that invoked suspicious DNS queries known from Cobalt Strike beacons
Date
2023-01-16 00:00:00
Modified
None
Id
0d18728b-f5bf-4381-9dcf-915539fff6c2
Tags
attack.command-and-control attack.t1071.004
Type
Community Rule
Link to Public Repo
Rule History
Author
Title
Date
Commit
Nasreddine Bencherchali
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12
Scan your endpoints, forensic images or collected files with our portable scanner THOR