Cobalt Strike Default Malleable C2 Beacon HTTP Communication

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•5

Detects network traffic consistent with the default configuration of a Cobalt Strike Malleable C2 Beacon. The rule identifies HTTP GET requests to a '/updates' URI path, accompanied by the specific default User-Agent string 'Mozilla/4.0 (compatible; MSIE 6.0)', which is commonly observed in uncustomized Cobalt Strike deployments.