Cobalt Strike DNS Beacon Pattern

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•2

This rule detects a specific pattern associated with Cobalt Strike DNS beacons. It looks for HTTP requests where the URI contains '/updates' and the User-Agent header is 'Mozilla/4.0'. This combination of indicators is often used by Cobalt Strike for command and control communication.