Cobalt Strike Default HTTP C2 Beacon Detection

Ankit Mehta@Secvyn

•updated Jun 30, 2026•1•0•6

Detects HTTP traffic patterns associated with default Cobalt Strike malleable C2 profiles, specifically identifying requests to /submit.php or /dpixel and the use of the default 'Mozilla/4.0 (compatible; MSIE 8.0;' User-Agent string.