Identifies strings used in Cobalt Strike Beacon DLL

Hunt Hypothesis

This detection rule identifies specific string signatures embedded within Cobalt Strike Beacon DLLs to uncover potential post-exploitation command and control infrastructure. Proactively hunting for these artifacts in Azure Sentinel is critical because Cobalt Strike is a ubiquitous adversary tool often deployed early in the kill chain, allowing analysts to detect stealthy lateral movement before significant compromise occurs.

YARA Rule

rule HKTL_CobaltStrike_Beacon_Strings {
   meta:
      author = "Elastic"
      description = "Identifies strings used in Cobalt Strike Beacon DLL"
      reference = "https://www.elastic.co/blog/detecting-cobalt-strike-with-memory-signatures"
      date = "2021-03-16"
      id = "af558aa2-a3dc-5a7a-bc74-42bb2246091c"
   strings:
      $s1 = "%02d/%02d/%02d %02d:%02d:%02d"
      $s2 = "Started service %s on %s"
      $s3 = "%s as %s\\%s: %d"
   condition:
      2 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

This rule contains 3 string patterns in its detection logic.

References

False Positive Guidance

Here are 5 specific false positive scenarios for the “Identifies strings used in Cobalt Strike Beacon DLL” detection rule, including suggested filters and exclusions:

Scenario: Legitimate Software Updates via MSI/EXE Installers
- Context: Enterprise-wide deployment of software (e.g., Microsoft Office 365 updates, Adobe Creative Cloud agents, or antivirus definitions) often utilizes standard DLL injection techniques that share common string signatures with Cobalt Strike. Specifically, the msiexec.exe process spawning child processes to load update modules may trigger this rule when those modules contain similar hex strings or function names (e.g., Beacon, Cobalt).
- Suggested Filter/Exclusion: Create an exclusion for the parent process path C:\Windows\System32\msiexec.exe and its immediate child processes where the command line contains /quiet or /passive. Alternatively, filter out events where the file hash matches known good hashes from your software inventory database.
Scenario: Scheduled PowerShell Maintenance Jobs
- Context: IT Operations teams frequently run scheduled PowerShell scripts (via Task Scheduler) to perform system health checks, log rotation, or configuration backups. These scripts often load helper DLLs for reporting or network connectivity testing that utilize standard Windows API calls identical to those found in the Cobalt Strike Beacon DLL strings.
- Suggested Filter/Exclusion: Exclude events where the parent process is powershell.exe and the command line arguments include specific keywords like -ExecutionPolicy Bypass, -File, or paths pointing to a dedicated admin script folder (e.g., C:\Scripts\Ops\Maintenance\).
Scenario: Endpoint Detection and Response (EDR) Scanning
- Context: Native EDR agents (such as CrowdStrike Falcon, Microsoft Defender for Endpoint, or SentinelOne) perform continuous