Cobalt Strike Lateral Movement

id: 1212ae5c-43cc-4c17-bcbb-d23cf9ad3483
name: Cobalt Strike Lateral Movement
description: |
  Microsoft has observed Bazacall using Cobalt Strike in order to move laterally to other machines on the network.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - AlertInfo
  - AlertEvidence
tactics:
- Lateral movement
query: |
  AlertInfo
  | where Title in("File dropped and launched from remote location", "Suspicious transfer of an executable file")
  // Joining in instances where Cobalt Strike's built-in PsExec is used for lateral movement
  | join AlertEvidence on $left.AlertId == $right.AlertId
  | where FileName matches regex @"^([a-z0-9]){7}\.exe$" and FileName matches regex "[0-9]{1,5}"