The CobaltStrike malware family.

Hunt Hypothesis

This rule detects the presence of Cobalt Strike beacon activity, which adversaries frequently employ to establish persistent command and control channels for lateral movement within compromised networks. SOC teams should proactively hunt for these indicators in Azure Sentinel because early identification of this low-severity family can reveal stealthy initial access points that often precede more critical data exfiltration or privilege escalation events.

YARA Rule

rule HKTL_Win_CobaltStrike: Commodity {
   meta:
      author = "[email protected]"
      date = "2021-05-25"
      description = "The CobaltStrike malware family."
      hash = "b041efb8ba2a88a3d172f480efa098d72eef13e42af6aa5fb838e6ccab500a7c"
      reference = "https://www.volexity.com/blog/2021/05/27/suspected-apt29-operation-launches-election-fraud-themed-phishing-campaigns/"
      id = "113ba304-261f-5c59-bc56-57515c239b6d"
   strings:
      $s1 = "%s (admin)" fullword
      $s2 = { 48 54 54 50 2F 31 2E 31 20 32 30 30 20 4F 4B 0D 0A 43 6F 6E 74 65 6E 74 2D 54 79 70 65 3A 20 61 70 70 6C 69 63 61 74 69 6F 6E 2F 6F 63 74 65 74 2D 73 74 72 65 61 6D 0D 0A 43 6F 6E 74 65 6E 74 2D 4C 65 6E 67 74 68 3A 20 25 64 0D 0A 0D 0A 00 }
      $s3 = "%02d/%02d/%02d %02d:%02d:%02d" fullword
      $s4 = "%s as %s\\%s: %d" fullword
      $s5 = "%s&%s=%s" fullword
      $s6 = "rijndael" fullword
      $s7 = "(null)"
   condition:
      all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

This rule contains 7 string patterns in its detection logic.

References

False Positive Guidance

False Positive Scenarios for “The CobaltStrike Malware Family” Rule

Scenario 1: Software Deployment via SCCM/Intune
- Context: Enterprise IT administrators frequently use Microsoft Endpoint Configuration Manager (SCCM) or Microsoft Intune to push software updates and patches. These tools often utilize the cbs.exe (Configuration Service Provider) or similar agents that execute commands with network connectivity patterns resembling Cobalt Strike’s beacon behavior, specifically when establishing persistent connections to update servers.
- Filter/Exclusion: Exclude processes where the parent process is ccmexec.exe (SCCM Client) or Microsoft.Intune.Management.Extension and the command line contains keywords like /update, /install, or specific package IDs known in your deployment inventory.
Scenario 2: Scheduled Backup Jobs Using Veeam or Commvault
- Context: Automated backup solutions such as Veeam Backup & Replication or Commvault often run scheduled jobs during off-hours that initiate network transfers to backup repositories. These agents frequently spawn child processes that open outbound TCP connections on standard ports (e.g., 443, 80) with high-frequency heartbeat intervals, which can mimic the beaconing mechanism of Cobalt Strike.
- Filter/Exclusion: Create an exclusion rule for process names Veeam.Backup.Service.exe, vbragent.exe, or CommServe.exe when they are initiated by a scheduled task named “Backup Job” and the destination IP belongs to your internal backup infrastructure subnet (e.g., 10.x.x.x).
Scenario 3: Endpoint Detection and Response (EDR) Scanner Updates
- Context: Security tools like CrowdStrike Falcon, SentinelOne, or Carbon Black perform regular definition updates and health checks. Their update agents often establish persistent connections to cloud repositories to download signatures,