Cobalt Strike Beaconing - Low-Variance Callback Interval
Detects periodic network connection patterns indicative of Cobalt Strike beaconing. The rule identifies low-variance jittered traffic, where the communication interval remains relatively consistent over a defined period, consistent with default Cobalt Strike malleable C2 profiles.
Microsoft Sentinel (KQL)
