Detects Cobalt Strike beacon loader

Hunt Hypothesis

This rule identifies the execution of a Cobalt Strike beacon loader, signaling an adversary’s initial deployment of a command-and-control infrastructure to establish persistent access within the network. Proactively hunting for this behavior in Azure Sentinel is essential because early detection of the beacon loader allows the SOC team to isolate compromised endpoints before the adversary can fully deploy its modular capabilities and exfiltrate sensitive data.

YARA Rule

rule MAL_CobaltStrike_Beacon_Loader_Feb26 {
   meta:
      description = "Detects Cobalt Strike beacon loader"
      author = "X__Junior"
      date = "2026-02-02"
      reference = "https://www.rapid7.com/blog/post/tr-chrysalis-backdoor-dive-into-lotus-blossoms-toolkit/"
      hash = "0a9b8df968df41920b6ff07785cbfebe8bda29e6b512c94a3b2a83d10014d2fd"
      hash = "b4169a831292e245ebdffedd5820584d73b129411546e7d3eccf4663d5fc5be3"
      score = 80
      id = "9d6888d0-64c6-5e52-a01a-8bcc51dd16b1"
   strings:
      $opa1 = { 45 33 C9 41 B8 ?? ?? ?? ?? 48 8D 94 24 ?? ?? ?? ?? 48 8D 4C 24 ?? E8 ?? ?? ?? ?? 48 8D 8C 24 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 66 89 44 24 ?? 41 B8 ?? ?? ?? ?? 48 8D 94 24 ?? ?? ?? ?? 0F B7 4C 24 ?? FF 15 ?? ?? ?? ?? 48 8D 8C 24 ?? ?? ?? ?? FF 15 }
      $opa2 = { 4C 8D 4C 24 ?? 41 B8 ?? ?? ?? ?? BA ?? ?? ?? ?? 48 8D 8C 24 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 48 C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 48 8D 8C 24 ?? ?? ?? ?? 48 89 4C 24 ?? 4C 8D 0D ?? ?? ?? ?? 45 33 C0 33 D2 48 8B C8 FF 15 }

      $opb1 = { 48 8D 89 ?? ?? ?? ?? 0F 10 00 0F 10 48 ?? 48 8D 80 ?? ?? ?? ?? 0F 11 41 ?? 0F 10 40 ?? 0F 11 49 ?? 0F 10 48 ?? 0F 11 41 ?? 0F 10 40 ?? 0F 11 49 ?? 0F 10 48 ?? 0F 11 41 ?? 0F 10 40 ?? 0F 11 49 ?? 0F 10 48 ?? 0F 11 41 ?? 0F 11 49 ?? 48 83 EA }
      $opb2 = { 45 33 C9 48 89 84 24 ?? ?? ?? ?? 41 B8 18 00 00 00 C7 84 24 ?? ?? ?? ?? 03 00 00 00 48 8D 94 24 ?? ?? ?? ?? 48 89 BC 24 ?? ?? ?? ?? B9 B9 00 00 00 FF 15 }
   condition:
      uint16(0) == 0x5a4d and
      all of ($opa*)
      or all of ($opb*)
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 4 string patterns in its detection logic.

References

• https://www.rapid7.com/blog/post/tr-chrysalis-backdoor-dive-into-lotus-blossoms-toolkit/
• Source Rule

False Positive Guidance

Here are 3-5 specific false positive scenarios for the Detects Cobalt Strike beacon loader rule, including suggested filters and exclusions:

• Scenario: Legitimate Software Deployment via SCCM/Intune

  • Context: Enterprise administrators often use Microsoft Endpoint Configuration Manager (SCCM) or Intune to deploy internal tools. These deployment agents frequently utilize the same DLL injection techniques or process spawning patterns (e.g., powershell.exe loading a specific assembly) that mimic the Cobalt Strike beacon loader signature.
  • Suggested Filter/Exclusion: Create an exclusion rule based on the Parent Process Name and User Context. Exclude alerts where the parent process is ccmexec.exe (SCCM) or IntuneManagementExtension.exe and the user account belongs to a specific “Deployment Admin” group.

• Scenario: Scheduled Maintenance Jobs using PowerShell

  • Context: IT operations teams often schedule nightly maintenance scripts that run via Task Scheduler. These scripts may use powershell.exe to load custom modules or execute remote commands, which can trigger the beacon loader detection logic due to similar memory allocation patterns and network socket creation.
  • Suggested Filter/Exclusion: Implement a filter based on Scheduled Task Name and Command Line Arguments. Exclude alerts where the command line contains specific keywords (e.g., --maintenance, --backup) or matches known internal script paths (e.g., C:\Scripts\Ops\Maintenance.ps1).

• Scenario: Endpoint Protection Scans by Third-Party AV Solutions

  • Context: Modern antivirus solutions like CrowdStrike Falcon, Microsoft Defender for Endpoint, or SentinelOne often employ “on-access” scanning engines that inject code into running processes to analyze behavior. This injection mechanism can be indistinguishable from the Cobalt Strike loader’s initial execution phase.