Cobalt Strike-style Beaconing: Jittered C2 with Consistent Byte Sizes/URIs
Detects potential C2 beaconing activity by identifying repeated network connections to the same external host that exhibit consistent payload sizes (low variance) and frequency, or by flagging HTTP requests containing default URI patterns associated with Cobalt Strike profiles.
CQL
