FrostyNeighbor Cobalt Strike URI Detection
Detects network connections to the Cobalt Strike C2 URI path '/statistics/discover.txt', indicating active communication from a FrostyNeighbor Cobalt Strike beacon. Identifying this beacon is critical for finding fully compromised hosts under active remote control.
Microsoft Sentinel (KQL)
