Sigma rule: Operator Bloopers Cobalt Strike Modules
A detection rule from the SigmaHQ repository, shown as its author published it. Dataset version ref-7e66dbe50218, updated 2023-01-30T00:00:00.000Z.
Rule
- Title
- Operator Bloopers Cobalt Strike Modules
- Status
- test
- Level
- high
- Author
- _pete_0, TheDFIRReport
- Date
- 2022-05-06
- Modified
- 2023-01-30
- File
- rules/windows/process_creation/proc_creation_win_hktl_cobaltstrike_bloopers_modules.yml
- Commit
- ccbb0369507f796db0b0ae6854c8a2be471b9d84
Detects Cobalt Strike module/commands accidentally entered in CMD shell
Log source
- product
- windows
- category
- process_creation
Detection
selection_img:
- OriginalFileName: 'Cmd.Exe'
- Image|endswith: '\cmd.exe'
selection_cli:
CommandLine|contains:
- 'Invoke-UserHunter'
- 'Invoke-ShareFinder'
- 'Invoke-Kerberoast'
- 'Invoke-SMBAutoBrute'
- 'Invoke-Nightmare'
- 'zerologon'
- 'av_query'
condition: all of selection_*False positives (as the rule lists them)
- Unknown
Tags
- attack.execution
- attack.t1059.003
MITRE ATT&CK ids this rule names
Related rules
References
- https://hstechdocs.helpsystems.com/manuals/cobaltstrike/current/userguide/content/cobalt-4-5-user-guide.pdf
- https://thedfirreport.com/2021/10/04/bazarloader-and-the-conti-leaks/
- https://thedfirreport.com/2022/06/16/sans-ransomware-summit-2022-can-you-detect-this/
Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_hktl_cobaltstrike_bloopers_modules.yml
Sources and licences
SigmaHQ
"Operator Bloopers Cobalt Strike Modules" by _pete_0, TheDFIRReport (SigmaHQ). Rule: https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_hktl_cobaltstrike_bloopers_modules.yml.
Licensed under the Detection Rule License (DRL) 1.1: https://github.com/SigmaHQ/Detection-Rule-License
Cite this page
Dragons Eye Ransomware Tracker, "Sigma rule: Operator Bloopers Cobalt Strike Modules",
entity page, dataset version ref-7e66dbe50218, updated 2023-01-30T00:00:00.000Z,
https://ransomware-tracker.com/detections/sigma/4f154fb6-27d1-4813-a759-78b93e0b9c48 (accessed 2026-11-03).
Underlying source: SigmaHQ rule 4f154fb6-27d1-4813-a759-78b93e0b9c48, commit ccbb0369507f796db0b0ae6854c8a2be471b9d84.
Pages change. The dataset version identifies the data, but no archive of old versions is kept, so this citation cannot be replayed later.