YARA rules for detecting Cobalt Strike beacons – sharing my collection
I’ve been maintaining a set of YARA rules for detecting Cobalt Strike beacons in memory and on disk. Sharing them here for the community. These…
Detecting data exfiltration over DNS tunneling
We recently discovered that an attacker was exfiltrating data from our network using DNS tunneling. The data was encoded in subdomain queries to an attacker-controlled…