TGI HUNT CobaltStrike Artifact in DNS

SID: 2610448Rev: 111 views
History
Sourcetgreen/hunting
CreatedMarch 19, 2025
UpdatedMarch 19, 2025
Classificationtrojan-activity
alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"TGI HUNT CobaltStrike Artifact in DNS"; flow:established,to_server; dns_query; content:".stage.123456."; reference:url,threatexpress.com/blogs/2018/a-deep-dive-into-cobalt-strike-malleable-c2/; classtype:trojan-activity; sid:2610448; rev:1;)

References

urlthreatexpress.com/blogs/2018/a-deep-dive-into-cobalt-strike-malleable-c2/

Comments (0)

Please sign in to leave a comment.
Sign in

No comments yet. Be the first to comment!