MediumSplunk security content Raven Tait +1

Windows Default Cobalt Strike PowerShell Beacon

Detects default function and variable names known to be used by the Cobalt Strike PowerShell beacon. This beacon is used to gain command and control on a victim.

Detection logic

Detection requirements

Platform: Linux macOS Windows
The rule states no platform. This is derived from the 2 ATT&CK techniques it maps to.
Log source category: powershell_script_block_logging_4104

Known benign triggers

False positives are very unlikely as this detection targets default Cobalt Strike PowerShell beacon functions and variables. Modifications to the beacon's script may bypass detection but do not create false positives.

Detection rules

Windows Default Cobalt Strike PowerShell Beacon

Detection logic

Detection requirements

Known benign triggers

MITRE ATT&CK mappings

From the source

Licence

Authorship

Detection rules