Cobalt Strike Beacon Network Traffic Detection
Detects network traffic associated with known Cobalt Strike Beacon request URI patterns. This rule utilizes network signature inspection to flag outbound connections containing URI fragments commonly used by Cobalt Strike default profiles.
Microsoft Sentinel (KQL)
