TLDR Tech / InfoSec
Detecting Cobalt Strike HTTP(S) Beacons with a Simple Method
Cobalt Strike's malleable C2 profiles let operators define multiple URIs for http-get and http-post blocks, but each beacon actually communicates using only one static GET URI and one static POST URI, which can even be identical. This fixed selection creates a detection chokepoint: defenders hunting through web proxy logs for internal hosts talking to low-prevalence domains or IPs that use only one or two unique URIs can surface potential Cobalt Strike beacon traffic. The piece is light on hardening specifics, so treat this as a starting heuristic for hunting rather than a full detection rule, and pair it with tuning to reduce false positives against legitimate low-traffic services.
Read the full story