Most Popular Detection 2026: Cobalt Strike Beacon C2 Traffic Patterns

Ibrahim Saud@tektrix

•updated 8 days ago•0•0•1

This rule detects network beaconing behavior consistent with Cobalt Strike's default malleable C2 profiles. It monitors HTTP GET and POST requests for specific URI patterns commonly used by default Cobalt Strike configurations and triggers when multiple such requests are observed from a single host over a 15-minute window.