paranoidninja / cobaltstrike-detection Goto Github PK

Just in case anyone else was curious about this rule, I ran it on a near-stock distribution of Windows 11 (with some applications installed) and these are the resulting matches:

The following rule matched the following process:
cs45_49_core 15608

Id ProcessName Path

15608 Docker Desktop C:\Program Files\Docker\Docker\Docker Desktop.exe
6172 IntelAudioService C:\WINDOWS\System32\DriverStore\FileRepository\intcoed.inf_amd64_06dd582276d3f601\AS\IAS\Inte...
C:\WINDOWS\System32\DriverStore\FileRepository\igcc_dch.inf_amd64_4e93878658043b21\OneAp...
20164 powershell C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe
7788 powershell_ise C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe
10780 PresentationFontCache C:\WINDOWS\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
15636 pycharm64 C:\Program Files\JetBrains\PyCharm 2023.2.2\bin\pycharm64.exe

I'm sure on a system with more normal use, there would be many more hits, as this is a laptop I rarely use. I would recommend seeking to tighten up the rule with additional qualifiers if you believe this is in fact a valid CS detection strategy.