Empire/PowerShell Empire C2 HTTP Agent Check-in Session Cookie

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•1

Detects HTTP traffic containing a specific session cookie pattern characteristic of PowerShell Empire C2 agent communication, utilizing regex to identify base64-encoded session identifiers.