Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

Everest – Cobalt Strike / Meterpreter Beacon Traffic Pattern

Everest Command and Control Sentinel
MITRE ATT&CK
Web Protocols
Data Source
DeviceNetworkEvents
Date Added
2026-07-23
Last Updated
2026-07-23
Source
ransomware.live group_tools dataset (everest)
What This Detects
Everest's post-access-broker intrusions rely on Cobalt Strike/Meterpreter for C2. Flags a high count of periodic outbound connections on common beacon ports from a single process – tune thresholds to your baseline before enabling as an alert.
Query
DeviceNetworkEvents
| where Timestamp > ago(1d)
| where RemotePort in (443, 8080, 4444)
| summarize ConnCount = count(), ActiveBins = dcount(bin(Timestamp, 5m)) by DeviceName, RemoteIP, InitiatingProcessFileName
| where ConnCount > 50 and ActiveBins > 10

Hunting queries are starting points for threat hunting & detection engineering — validate table/column names against your own workspace schema and tune thresholds before turning any of these into a production alert rule.