Cobalt Strike Default TLS Certificate Detected

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•2

This rule detects network traffic that uses a TLS certificate with the common name (CN) 'Major Cobalt Strike'. This specific CN is a known default value used by the Cobalt Strike command and control (C2) framework. Detection of this certificate indicates potential Cobalt Strike C2 communication within the network.