Detects CobaltStrike beacons

Hunt Hypothesis

This rule detects the presence of Cobalt Strike beacon processes, which adversaries frequently deploy to establish persistent command-and-control channels for lateral movement and data exfiltration. Proactive hunting is essential in Azure Sentinel because these beacons often mimic legitimate system behavior, allowing attackers to remain undetected during early stages of an intrusion despite their low initial severity rating.

YARA Rule

rule APT_CobaltStrike_Beacon_Indicator {
   meta:
      description = "Detects CobaltStrike beacons"
      author = "JPCERT"
      reference = "https://github.com/JPCERTCC/aa-tools/blob/master/cobaltstrikescan.py"
      date = "2018-11-09"
      id = "8508c7a0-0131-59b1-b537-a6d1c6cb2b35"
   strings:
      $v1 = { 73 70 72 6E 67 00 }
      $v2 = { 69 69 69 69 69 69 69 69 }
   condition:
      uint16(0) == 0x5a4d and filesize < 300KB and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

References

False Positive Guidance

Here are 3-5 specific false positive scenarios for the “Detects CobaltStrike beacons” rule, including suggested filters and exclusions:

Legitimate Enterprise Endpoint Management Tools
- Scenario: Security teams often deploy endpoint management solutions (e.g., Microsoft System Center Configuration Manager (SCCM), Ivanti Neurons, or Tanium) that utilize similar beaconing mechanisms to push updates, collect inventory data, and execute remote commands. These tools frequently establish periodic HTTP/HTTPS connections to central servers with timing intervals and User-Agent strings that mimic Cobalt Strike’s default behavior.
- Suggested Filter: Exclude traffic originating from known management server IPs or filter by specific User-Agent headers unique to the enterprise tool (e.g., filtering out SCCM-Client or Tanium-Agent).
Scheduled Administrative Maintenance Jobs
- Scenario: IT Operations teams often configure scheduled tasks on Windows servers and workstations that run nightly backup scripts, patch compliance checks, or log rotation jobs. These jobs may be scripted using PowerShell or Python to query external APIs for status updates, creating periodic outbound connections (e.g., every 15 minutes) that resemble the heartbeat pattern of a Cobalt Strike beacon.
- Suggested Filter: Create an exclusion based on specific Process Name and Command Line arguments associated with known administrative scripts (e.g., exclude processes named BackupAgent.exe or PowerShell jobs containing keywords like “ComplianceCheck”).
Cloud-Based SaaS Application Heartbeats
- Scenario: Modern enterprise applications such as Salesforce, ServiceNow, or Microsoft Teams often run background agents on user endpoints to sync data, check for policy updates, and maintain session states. These agents generate regular outbound traffic with consistent intervals (e.g., every 5-10 minutes) that can