Cobalt Strike Default Beacon Checkin

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•3

This rule detects default beacon check-ins from Cobalt Strike. It specifically looks for HTTP POST requests to the URI '/submit.php' with a User-Agent string matching the pattern 'Mozilla/5.0 (compatible; MSIE [0-9]/'. This combination of indicators is characteristic of the default configuration of Cobalt Strike's beacon communication.