Most Popular Detection 2026: Cobalt Strike Beacon C2 Communication Detection
Detects potential Cobalt Strike or Sliver command and control (C2) beaconing behavior by analyzing network proxy, firewall, and flow logs for common C2 URI patterns, known malicious JA3/JA3S TLS fingerprints, and consistent periodic communication intervals (low jitter) characteristic of automated beacons.
Splunk (SPL)
