Identifies XOR'd strings used in Cobalt Strike Beacon DLL

Hunt Hypothesis

This rule detects adversaries employing Cobalt Strike’s Beacon DLL to obfuscate command and control traffic through XOR-encoded strings, a technique often used to evade signature-based detection during post-exploitation phases. SOC teams should proactively hunt for this behavior in Azure Sentinel because identifying these specific XOR patterns early allows analysts to uncover stealthy lateral movement activities that might otherwise remain hidden within standard network logs.

YARA Rule

rule HKTL_CobaltStrike_Beacon_XOR_Strings {
   meta:
      author = "Elastic"
      description = "Identifies XOR'd strings used in Cobalt Strike Beacon DLL"
      reference = "https://www.elastic.co/blog/detecting-cobalt-strike-with-memory-signatures"
      date = "2021-03-16"
      modified = "2026-05-26"
      /* Used for beacon config decoding in THOR */
      xor_s1 = "%02d/%02d/%02d %02d:%02d:%02d"
      xor_s2 = "Started service %s on %s"
      xor_s3 = "%s as %s\\%s: %d"
      id = "359160a8-cf1c-58a8-bf7f-c09a8d661308"
   strings:
      $s1 = "%02d/%02d/%02d %02d:%02d:%02d" xor(0x01-0xff)
      $s2 = "Started service %s on %s" xor(0x01-0xff)
      $s3 = "%s as %s\\%s: %d" xor(0x01-0xff)

      $fp1 = "MalwareRemovalTool" ascii wide
      $fp2 = "advanced malware removal tool" ascii wide
   condition:
      2 of ($s*) and not 1 of ($fp*)
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

This rule contains 5 string patterns in its detection logic.

References

False Positive Guidance

Here are 5 specific false positive scenarios for the Cobalt Strike Beacon DLL XOR String detection rule, including targeted filters and exclusions:

Scenario: Automated Backup & Archiving Tools
- Context: Enterprise backup solutions like Veeam Backup & Replication or Acronis Cyber Protect often utilize custom compression algorithms that apply XOR operations to file headers and metadata strings during the archiving process. When these tools run scheduled jobs (e.g., nightly full backups), they generate memory patterns identical to Cobalt Strike’s string obfuscation technique.
- Suggested Filter/Exclusion: Create an exclusion rule based on the specific process names of the backup agents, such as Veeam.Backup.Service.exe or Acronis.Agent.exe, and limit the detection scope to exclude processes running under the SYSTEM account during standard maintenance windows (e.g., 02:00–04:00 local time).
Scenario: Endpoint Detection & Response (EDR) Scanning
- Context: Modern EDR platforms like CrowdStrike Falcon, Microsoft Defender for Endpoint, or SentinelOne frequently employ XOR-based string obfuscation within their kernel-mode drivers and real-time scanning modules to hide heuristic signatures from memory scanners. During a full system scan or policy update, these agents may trigger the detection logic.
- Suggested Filter/Exclusion: Implement a whitelist for known EDR process binaries (e.g., Cns.exe, MsMpEng.exe, SentinelOneAgent.exe). Additionally, add a filter to suppress alerts if the XOR’d string length is greater than 4KB, as Cobalt Strike Beacon strings are typically shorter and more concise.
Scenario: Software Deployment & Configuration Management
- Context: Tools such as **Microsoft SCCM (