Identifies deobfuscation routine used in Cobalt Strike Beacon DLL version 4.2

Hunt Hypothesis

This rule detects the specific deobfuscation routine employed by Cobalt Strike Beacon DLL version 4.2, which adversaries often use to hide command-and-control traffic and evade signature-based detection. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify early-stage post-exploitation activities that may indicate a persistent threat actor leveraging the widely adopted Cobalt Strike framework.

YARA Rule

rule HKTL_CobaltStrike_Beacon_4_2_Decrypt {
   meta:
      author = "Elastic"
      description = "Identifies deobfuscation routine used in Cobalt Strike Beacon DLL version 4.2"
      reference = "https://www.elastic.co/blog/detecting-cobalt-strike-with-memory-signatures"
      date = "2021-03-16"
      id = "63b71eef-0af5-5765-b957-ccdc9dde053b"
   strings:
      $a_x64 = { 4C 8B 53 08 45 8B 0A 45 8B 5A 04 4D 8D 52 08 45 85 C9 75 05 45 85 DB 74 33 45 3B CB 73 E6 49 8B F9 4C 8B 03 }
      $a_x86 = { 8B 46 04 8B 08 8B 50 04 83 C0 08 89 55 08 89 45 0C 85 C9 75 04 85 D2 74 23 3B CA 73 E6 8B 06 8D 3C 08 33 D2 }
   condition:
      any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

References

False Positive Guidance

Here are specific false positive scenarios for the Cobalt Strike Beacon DLL v4.2 Deobfuscation detection rule, including suggested filters and exclusions:

Scenario: Microsoft Defender for Endpoint (MDE) Real-Time Protection Scanning
- Context: When MDE performs a real-time scan on a large executable or script in the %TEMP% directory, its internal deobfuscation engine may mimic the byte-pattern signature of Cobalt Strike’s v4.2 routine while unpacking nested payloads. This is common during automated patch deployments where scripts are extracted and executed.
- Suggested Filter/Exclusion: Exclude processes originating from C:\Program Files\Microsoft Defender\MsMpEng.exe or any process running under the SYSTEM account that executes within the %TEMP% directory, specifically filtering by file hash if a known baseline exists for MDE’s deobfuscation module.
Scenario: Scheduled PowerShell Script Execution via Task Scheduler
- Context: An enterprise-wide scheduled task (e.g., “Daily Inventory Report”) runs a complex PowerShell script that utilizes the System.Reflection assembly to dynamically load and execute internal helper DLLs. The reflection loading mechanism often triggers the same deobfuscation signature identified by the rule, particularly if the script uses .NET Core 4.x libraries which share structural similarities with Cobalt Strike’s v4.2 implementation.
- Suggested Filter/Exclusion: Create an exclusion for powershell.exe processes launched directly by Task Scheduler (check command line arguments for /ScheduledTaskID) that do not spawn child processes named beacon64.dll or csbeacon.exe.
Scenario: Endpoint Detection and Response (EDR) Agent Self-Healing Routine
- Context: Major EDR solutions like CrowdStrike Falcon or SentinelOne periodically