Sign in Get started

Threat report

thedfirreport.com/2021/08/29/cobalt-strike-a-defenders-guide

https://thedfirreport.com/2021/08/29/cobalt-strike-a-defenders-guide/

Published on: thedfirreport.com

ATT&CK techniques those detections carry

T1021.002SMB/Windows Admin Shares
T1543.003Windows Service
T1569.002Service Execution
T1055Process Injection
T1059Command and Scripting Interpreter
T1059.001PowerShell
T1106Native API
T1620Reflective Code Loading

Open the original

5 published detections cite this

Citing it, not covering it: each of these was written with this as evidence, and carries the source it came from and the licence it was published under.

Detections citing this reference
Detection	Severity	Source	Published	Licence
Process Creation Using Sysnative Folder	Medium	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
Potential CobaltStrike Process Patterns	High	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
Potential WinAPI Calls Via PowerShell Scripts	High	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
CobaltStrike Service Installations - System	Critical	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
CobaltStrike Service Installations - Security	High	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1

Showing 5 of 5

Filter in the catalogue

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice