attack.s0154

Default Cobalt Strike Certificate

Aug 12, 2024 · attack.command-and-control attack.s0154 ·

Detects the presence of default Cobalt Strike certificate in the HTTPS traffic

Cobalt Strike Beacon Getsystem Pattern (RedCanary Threat Detection Report)

May 10, 2023 · attack.s0154 ·

Detects command line pattern indicating the use of Cobalt Strike GetSystem feature. Part of the RedCanary 2023 Threat Detection Report.

Cobalt Strike Beacon Implant Command Issued via Named Pipe (RedCanary Threat Detection Report)

May 10, 2023 · attack.s0154 ·

Share on:

Detects named pipe creation indicating Cobalt Strike beacon implant issuing commands via SMB named pipe. Part of the RedCanary 2023 Threat Detection Report.

Cobalt Strike UAC Bypass Using SQL Server Client Configuration Utility (RedCanary Threat Detection Report)

May 10, 2023 · attack.s0154 ·

Share on:

Detects a possible Cobalt Strike UAC bypass attempt using cliconfg.exe, the SQL Server Client Configuration Utility. Part of the RedCanary 2023 Threat Detection Report.