Detectionhightest

HackTool - Potential CobaltStrike Process Injection

Detects a potential remote threat creation with certain characteristics which are typical for Cobalt Strike beacons

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Olaf Hartong, Florian Roth (Nextron Systems), Aleksey Potapov, oscd.communityCreated Fri Nov 30Updated Fri May 056309645e-122d-4c5b-bb2b-22e4f9c2fa42windows

Log Source

WindowsRemote Thread Creation

ProductWindows← raw: windows

CategoryRemote Thread Creation← raw: create_remote_thread

Detection Logic

detection:
    selection:
        StartAddress|endswith:
            - '0B80'
            - '0C7C'
            - '0C88'
    condition: selection

False Positives

Unknown

False positive likelihood has not been assessed. Additional context may be needed during triage.

References

MITRE ATT&CK

Tactics

Sub-techniques

Rule Metadata

Rule ID

6309645e-122d-4c5b-bb2b-22e4f9c2fa42

Status

test

Level

high

Type

Detection

Created

Fri Nov 30

Modified

Fri May 05

Author

Path

rules/windows/create_remote_thread/create_remote_thread_win_hktl_cobaltstrike.yml

Raw Tags

attack.privilege-escalationattack.defense-evasionattack.t1055.001