cobalt-strike

Description

This query was originally published in the threat analytics report, Ransomware continues to hit healthcare, critical services. There is also a related blog. In April of 2020, security researchers observed multiple ransomware campaigns using the same set of techniques. The attackers would compromise a web-facing endpoint and employ tools such as Cobalt Strike to steal users' credentials. Cobalt Strike is commercial software used to conduct simulated threat campaigns against a target; however, malicious actors also use Cobalt Strike in real attacks. The software has a large range of capabilities, including credential theft. The following query identifies accounts that have logged on to compromised endpoints and have potentially had their credentials stolen. References: https://www.microsoft.com/security/blog/2020/04/28/ransomware-groups-continue-to-target-healthcare-critical-services-heres-how-to-reduce-risk/ https://www.cobaltstrike.com/ https://attack.mitre.org/software/S0154/

Query · kql

// Check for specific alerts
AlertInfo
// Attempts to clear security event logs.
| where Title in("Event log was cleared", 
// List alerts flagging attempts to delete backup files.
"File backups were deleted", 
// Potential Cobalt Strike activity - Note that other threat activity can also 
//trigger alerts for suspicious decoded content
"Suspicious decoded content", 
// Cobalt Strike activity
"\'Atosev\' malware was detected", 
"\'Ploty\' malware was detected", 
"\'Bynoco\' malware was detected")
| extend AlertTime = Timestamp
| join AlertEvidence on AlertId 
| distinct DeviceName, AlertTime, AlertId, Title
| join DeviceLogonEvents on $left.DeviceName == $right.DeviceName
// Creating 10 day Window surrounding alert activity
| where Timestamp < AlertTime +5d and Timestamp > AlertTime - 5d 
// Projecting specific columns
| project Title, DeviceName, DeviceId, Timestamp, LogonType, AccountDomain, 
AccountName, AccountSid, AlertTime, AlertId, RemoteIP, RemoteDeviceName
Raw source cobalt-strike · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 0a6e58fa-0689-418e-b05c-758c41664081
name: cobalt-strike
description: |
  This query was originally published in the threat analytics report, Ransomware continues to hit healthcare, critical services. There is also a related blog.
  In April of 2020, security researchers observed multiple ransomware campaigns using the same set of techniques. The attackers would compromise a web-facing endpoint and employ tools such as Cobalt Strike to steal users' credentials.
  Cobalt Strike is commercial software used to conduct simulated threat campaigns against a target; however, malicious actors also use Cobalt Strike in real attacks. The software has a large range of capabilities, including credential theft.
  The following query identifies accounts that have logged on to compromised endpoints and have potentially had their credentials stolen.
  References:
  https://www.microsoft.com/security/blog/2020/04/28/ransomware-groups-continue-to-target-healthcare-critical-services-heres-how-to-reduce-risk/
  https://www.cobaltstrike.com/
  https://attack.mitre.org/software/S0154/
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - AlertInfo
  - AlertEvidence
  - DeviceLogonEvents
tactics:
- Initial access
- Credential Access
- Malware, component
query: |
  // Check for specific alerts
  AlertInfo
  // Attempts to clear security event logs.
  | where Title in("Event log was cleared", 
  // List alerts flagging attempts to delete backup files.
  "File backups were deleted", 
  // Potential Cobalt Strike activity - Note that other threat activity can also 
  //trigger alerts for suspicious decoded content
  "Suspicious decoded content", 
  // Cobalt Strike activity
  "\'Atosev\' malware was detected", 
  "\'Ploty\' malware was detected", 
  "\'Bynoco\' malware was detected")
  | extend AlertTime = Timestamp
  | join AlertEvidence on AlertId 
  | distinct DeviceName, AlertTime, AlertId, Title
  | join DeviceLogonEvents on $left.DeviceName == $right.DeviceName
  // Creating 10 day Window surrounding alert activity
  | where Timestamp < AlertTime +5d and Timestamp > AlertTime - 5d 
  // Projecting specific columns
  | project Title, DeviceName, DeviceId, Timestamp, LogonType, AccountDomain, 
  AccountName, AccountSid, AlertTime, AlertId, RemoteIP, RemoteDeviceName

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.