Cobalt Strike Beacon HTTP C2 Check-in Short URI No Referer

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•3

This rule detects potential Cobalt Strike Beacon check-in activity over HTTP. It identifies incoming GET requests where the URI is abnormally short and the HTTP Referer header is missing, which are common indicators of default Cobalt Strike malleable C2 profiles.