Cobalt Strike Default HTTP Beacon jQuery Malleable C2 URI Pattern

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•1

Detects network traffic consistent with the default Cobalt Strike Malleable C2 jQuery profile. The rule monitors for GET requests to the URI '/jquery-3.3.1.min.js' accompanied by a specific 'Accept' HTTP header, which is a known indicator of default Cobalt Strike beacon activity.