rules: cobalt strike rules refactored

rules/windows/builtin/win_cobaltstrike_service_installs.yml

@@ -5,8 +5,9 @@ author: Florian Roth, Wojciech Lesicki
 references:
     - https://www.sans.org/webcasts/119395
     - https://www.crowdstrike.com/blog/getting-the-bacon-from-cobalt-strike-beacon/
+    - https://thedfirreport.com/2021/08/29/cobalt-strike-a-defenders-guide/
 date: 2021/05/26
-modified: 2021/08/09
+modified: 2021/08/30
 tags:
     - attack.execution
     - attack.privilege_escalation
@@ -19,7 +20,9 @@ logsource:
     service: system
 detection:
     selection_id:
-        EventID: 7045
+        EventID: 
+            - 7045
+            - 4697
     selection1:
         ServiceFileName|contains|all: 
             - 'ADMIN$'

rules/windows/process_creation/win_cobaltstrike_process_patterns.yml

@@ -5,7 +5,9 @@ description: Detects process patterns found in Cobalt Strike beacon activity (se
 author: Florian Roth
 references:
     - https://hausec.com/2021/07/26/cobalt-strike-and-tradecraft/
+    - https://thedfirreport.com/2021/08/29/cobalt-strike-a-defenders-guide/
 date: 2021/07/27
+modified: 2021/08/30
 tags:
     - attack.execution
 logsource:
@@ -27,6 +29,10 @@ detection:
             - '> \\.\pipe'
             - '\whoami.exe'
         ParentImage|endswith: '\dllhost.exe'
+    selection4:
+        Image|endswith: '\cmd.exe'
+        ParentImage|endswith: '\runonce.exe'
+        ParentCommandLine|endswith: '\runonce.exe'
     condition: 1 of them
 falsepositives:
     - Other programs that cause these patterns (please report)