APT24 BADAUDIO - Cobalt Strike Beacon Watermark Detection

Daniel Jeremiah@daniyyell

•updated Jan 18, 2026•0•34

Detects Cobalt Strike Beacon payloads, specifically those associated with the APT24 BADAUDIO campaign, by looking for a unique watermark hash in command-line arguments or specific beacon executable/DLL names during process creation. The rule targets the Cobalt Strike Beacon watermark hash "BeudtKgqnlm0Ruvf+VYxuw==" and a generic "Watermark_Hash" string, alongside process images ending with '\beacon.exe' or '\beacon.dll'.