Query: Sigma rule for Detects the presence of default Cobalt Strike certificate in the HTTPS traffic
Matching passage: Sigma rule: Detects the presence of default Cobalt Strike certificate in the HTTPS traffic. Logsource: zeek / x509. Rule: title: Default Cobalt Strike Certificate id: 7100f7e3-92ce-4584-b7b7-01b40d3d4118 status: test description: Detects the presence of default Cobalt Strike certificate in the HTTPS traffic references: - https://sergiusechel.medium.com/improving-the-network-based-detection-of-cobalt-strike-c2-servers-in-the-wild-while-reducing-the-6964205f6468 author: Bhabesh Raj date: 2021-06-23 modified: 2022-10-09 tags: - attack.command-and-control - attack.s0154 logsource: product: zeek service: x509 detection: selection: certificate.serial: 8BB00EE condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects DLL sideloading of DLLs usually located in system locations (System32, SysWOW64, etc.).. Logsource: windows / image_load. Rule: title: Potential System DLL Sideloading From Non System Locations id: 4fc0deee-0057-4998-ab31-d24e46e0aba4 status: test description: Detects DLL sideloading of DLLs usually located in system locations (System32, SysWOW64, etc.). references: - https://hijacklibs.net/ - https://blog.cyble.com/2022/07/21/qakbot-resurfaces-with-new-playbook/ - https://blog.cyble.com/2022/07/27/targeted-attacks-being-carried-out-via-dll-sideloading/ - https://github.com/XForceIR/SideLoadHunter/blob/cc7ef2e5d8908279b0c4cee4e8b6f85f7b8eed52/SideLoads/README.md - https://www.hexacorn.com/blog/2023/12/26/1-little-known-secret-of-runonce-exe-32-bit/ - https://www.sophos.com/en-us/blog/finding-minhook-in-a-sideloading-attack-and-sweden-too author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-14 modified: 2026-07-10 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: ImageLoaded|endswith: - \aclui.dll - \activeds.dll - \adsldpc.dll - \aepic.dll - \apphelp.dll - \applicationframe.dll - \appvpolicy.dll - \appxalluserstore.dll - \appxdeploymentclient.dll - \archiveint.dll - \atl.dll - \audioses.dll - \auditpolcore.dll - \authfwcfg.dll - \authz.dll - \avrt.dll - \batmeter.dll - \bcd.dll - \bcp47langs.dll - \bcp47mrm.dll - \bcrypt.dll - \bderepair.dll - \bootmenuux.dll - \bootux.dll - \cabinet.dll - \cabview.dll - \certcli.dll - \certenroll.dll - \cfgmgr32.dll - \cldapi.dll - \clipc.dll - \clusapi.dll - \cmpbk32.dll - \cmutil.dll - \coloradapterclient.dll - \colorui.dll - \comdlg32.dll - \configmanager2.dll - \connect.dll - \coredplus.dll - \coremessaging.dll - \coreuicomponents.dll - \credui.dll - \cryptbase.dll - \cryptdll.dll - \cryptsp.dll - \cryptui.dll - \cryptxml.dll - \cscapi.dll - \cscobj.dll - \cscui.dll - \d2d1.dll - \d3d10_1.dll - \d3d10_1core.dll - \d3d10.dll - \d3d10core.dll - \d3d10warp.dll - \d3d11.dll - \d3d12.dll - \d3d9.dll - \d3dx9_43.dll - \dataexchange.dll - \davclnt.dll - \dcntel.dll - \dcomp.dll - \defragproxy.dll - \desktopshellext.dll - \deviceassociation.dll - \devicecredential.dll - \devicepairing.dll - \devobj.dll - \devrtl.dll - \dhcpcmonitor.dll - \dhcpcsvc.dll - \dhcpcsvc6.dll - \directmanipulation.dll - \dismapi.dll - \dismcore.dll - \dmcfgutils.dll - \dmcmnutils.dll - \dmcommandlineutils.dll - \dmenrollengine.dll - \dmenterprisediagnostics.dll - \dmiso8601utils.dll - \dmoleaututils.dll - \dmprocessxmlfiltered.dll - \