LoFP LoFP / this rule should be tailored to either exclude systems, as sources or destinations, in which this behavior is expected.

Techniques

Sample rules

Cobalt Strike Command and Control Beacon

Description

Cobalt Strike is a threat emulation platform commonly modified and used by adversaries to conduct network attack and exploitation campaigns. This rule detects a network activity algorithm leveraged by Cobalt Strike implant beacons for command and control.

Detection logic

from packetbeat-*, filebeat-*, logs-network_traffic.* metadata _id, _version, _index
| where (
    (event.category in ("network", "network_traffic") and network.protocol in ("tls", "http")) or
    data_stream.dataset in ("network_traffic.tls", "network_traffic.http")
  )
| where destination.domain RLIKE "[a-z]{3}\\.stage\\.[0-9]{8}\\..*"
| keep @timestamp, destination.domain, source.ip, destination.ip, network.protocol, data_stream.dataset, _id, _version, _index