rules/windows/create_remote_thread/sysmon_cobaltstrike_process_injection.yml

title: CobaltStrike Process Injection
id: 6309645e-122d-4c5b-bb2b-22e4f9c2fa42
description: Detects a possible remote threat creation with certain characteristics which are typical for Cobalt Strike beacons
references:
    - https://medium.com/@olafhartong/cobalt-strike-remote-threads-detection-206372d11d0f
    - https://blog.cobaltstrike.com/2018/04/09/cobalt-strike-3-11-the-snake-that-eats-its-tail/
tags:
    - attack.defense_evasion
    - attack.t1055.001
status: experimental
author: Olaf Hartong, Florian Roth, Aleksey Potapov, oscd.community
date: 2018/11/30
modified: 2021/11/20
logsource:
    product: windows
    category: create_remote_thread
detection:
    selection:
        StartAddress|endswith: 
            - '0B80'
            - '0C7C'
            - '0C88'
    condition: selection
falsepositives:
    - Unknown
level: high
Added UUIDs to rules 2019-11-12 23:12:27 +01:00			`title: CobaltStrike Process Injection`
			`id: 6309645e-122d-4c5b-bb2b-22e4f9c2fa42`
			`description: Detects a possible remote threat creation with certain characteristics which are typical for Cobalt Strike beacons`
rule: Cobalt Strike beacon detection via Remote Threat Creation 2018-11-30 10:25:05 +01:00			`references:`
			`- https://medium.com/@olafhartong/cobalt-strike-remote-threads-detection-206372d11d0f`
improve sysmon_cobaltstrike_process_injection.yml 2019-11-08 01:41:26 +03:00			`- https://blog.cobaltstrike.com/2018/04/09/cobalt-strike-3-11-the-snake-that-eats-its-tail/`
atc review 2019-03-06 05:25:12 +01:00			`tags:`
			`- attack.defense_evasion`
review windows/sysmon 2020-08-29 02:03:28 +02:00			`- attack.t1055.001`
rule: Cobalt Strike beacon detection via Remote Threat Creation 2018-11-30 10:25:05 +01:00			`status: experimental`
improve sysmon_cobaltstrike_process_injection.yml 2019-11-08 01:41:26 +03:00			`author: Olaf Hartong, Florian Roth, Aleksey Potapov, oscd.community`
			`date: 2018/11/30`
$frack113$ Fix field name 2021-11-20 19:14:59 +01:00			`modified: 2021/11/20`
rule: Cobalt Strike beacon detection via Remote Threat Creation 2018-11-30 10:25:05 +01:00			`logsource:`
			`product: windows`
- Created new categories for sysmon events 2020-09-30 20:44:14 +02:00			`category: create_remote_thread`
rule: Cobalt Strike beacon detection via Remote Threat Creation 2018-11-30 10:25:05 +01:00			`detection:`
			`selection:`
$frack113$ Fix field name 2021-11-20 19:14:59 +01:00			`StartAddress\|endswith:`
improve sysmon_cobaltstrike_process_injection.yml 2019-11-08 01:41:26 +03:00			`- '0B80'`
			`- '0C7C'`
			`- '0C88'`
rule: Cobalt Strike beacon detection via Remote Threat Creation 2018-11-30 10:25:05 +01:00			`condition: selection`
			`falsepositives:`
fix: unknown --> Unknown 2022-03-16 13:43:54 +01:00			`- Unknown`
rule: Cobalt Strike beacon detection via Remote Threat Creation 2018-11-30 10:25:05 +01:00			`level: high`