proc_creation_win_cobaltstrike_operator_bloopers_cmds.yml

title: Operator Bloopers Cobalt Strike Commands
id: f127a4d7-5246-4e22-aa8d-a97d05e4f1a7
status: experimental
description: Detects use of Cobalt Strike commands accidentally entered in the CMD shell
author: _pete_0, TheDFIRReport
references:
  - https://hstechdocs.helpsystems.com/manuals/cobaltstrike/current/userguide/content/cobalt-4-5-user-guide.pdf
date: 2022/05/06
modified: 2022/05/06
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains:
      - psinject
      - spawnas
      - socks
      - make_token
      - remote-exec
      - rev2self
      - shell
      - dcsync
      - upload
      - sleep
      - ls
      - logonpasswords
      - ps
      - execute-assembly
      - pth
      - getsystem
    Image|endswith:
      - '\cmd.exe'
  condition: selection
fields:
  - CommandLine
falsepositives:
  - Unknown
level: high
tags:
  - attack.execution
  - attack.t1059.003