Cobalt Strike Default Malleable C2 HTTP Beacon GET/POST Pattern

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•1

Detects HTTP beaconing activity indicative of Cobalt Strike Malleable C2 communication. The rule monitors for specific URI patterns ('/updates', '/pixel', '/submit.php') in combination with a default User-Agent string commonly used by Cobalt Strike malleable profiles.