Cobalt Strike default self-signed TLS cert / default JA3 C2 check-in

Ankit Mehta@Secvyn

•updated 7 days ago•0•0•0

Detects outbound network traffic exhibiting the default self-signed TLS certificate subject and issuer fields 'O=Cobalt Strike' combined with the known default JA3 fingerprint '72a589da586844d7f0818ce684948eea' associated with Cobalt Strike C2 communication.