Cobalt Strike Default Malleable C2 HTTP Beacon Detection

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•2

Detects HTTP beaconing activity to a /submit.php URI with a default Cobalt Strike User-Agent string. This is indicative of a default or poorly customized Cobalt Strike malleable C2 profile being used for command and control communication.