Cobalt Strike Malleable C2 Default Profile HTTP Beacon URIs

Ankit Mehta@Secvyn

•updated 28 days ago•1•0•4

Detects HTTP beacon traffic patterns indicative of Cobalt Strike malleable C2 profiles using default URI paths and User-Agent strings. This rule identifies common default configurations often left unchanged during adversarial deployment, allowing for the detection of beacon communication over HTTP.