Cobalt Strike Malleable C2 Profile Patterns - Proxy

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•33

This rule detects Cobalt Strike Malleable C2 profile patterns by analyzing HTTP proxy logs. It looks for specific User-Agent strings, HTTP methods (GET/POST), URIs, and hostnames that are characteristic of known Cobalt Strike profiles, including those mimicking Amazon, generic browsers, OCSP, and OneDrive traffic. The rule aims to identify command and control communications attempting to blend in with legitimate web traffic.